Jeff Gilbert's Web blog at myITforum.com

Customizing Configuration Manager 2007 Resource Explorer Icons

jgilbert — Sat, 14 Mar 2009 19:30:00 GMT

If you read the post on how to customize SMS 2003 Resource Explorer icons, then you'll have the history behind why I decided to figure this out. You probably also noticed that I said not to try those steps on Configuration Manager 2007 sites and wondered why.

After figuring out how Resource Explorer decides on which icon to display in SMS 2003, I started poking around a Configuration Manager 2007 installation…and noticed that the files I was looking for either didn't exist or didn't work the same way. Sure, you might find some of the files that I referenced for configuring SMS 2003 icons, but they won't help you out in this particular endeavor. Resource Explorer was recoded for Configuration Manager and changes were made to how these icons are assigned.

In fact, if you try to do it the other way, you'll end up with things like this in your resourceexplorer.log file:

The 'resource' (Microsoft.ConfigurationManagement.AdminConsole.UIResources.SMS_G_System_PHYSICAL_MEMORY.resources) was not found.\r\nSystem.Resources.MissingManifestResourceException\r\nCould not find any resources appropriate for the specified culture or the neutral culture. Make sure "Microsoft.ConfigurationManagement.AdminConsole.UIResources.SMS_G_System_PHYSICAL_MEMORY.resources" was correctly embedded or linked into assembly "AdminUI.UiResources" at compile time, or that all the satellite assemblies required are loadable and fully signed.\r\n at System.Resources.ResourceManager.InternalGetResourceSet(CultureInfo culture, Boolean createIfNotExists, Boolean tryParents)

"Linked into assembly AdminUI.UiResources" …eh? what? After giving the log the 'what look' for about 30 seconds, I decided it was time to call for back up. Its times like these that make me happy to work on the team that I'm on—I just had to find the developer who made the changes and/or knew enough about the process to give me a hint. Luckily, that person appeared from the mists (OK, really the third floor of my office building) with all the answers I was looking for—cue Jun Wang 'developer extaordinaire'.

So, after some wise words from Jun, it became apparent that I should forget everything I knew about how to do this in SMS 2003. The files you should concern yourself with in Configuration Manager sites are the adminui.uiresources.dll and the managementclassdescriptions.xml files:

The adminui.uiresources.dll file (located at .\Microsoft Configuration Manager\AdminUI\bin\adminui.uiresources.dll) contains all of the icons used in Configuration Manager's implementation of Resource Explorer.
The managementclassdescriptions.xml (located at .\Microsoft Configuration Manager\AdminUI\XmlStorage\ConsoleRoot\managementclassdescriptions.xml) is the file that tells Resource Explorer which icon to display.

Important: As usual with "hacks" like this, the information in this post is in no way supported by Microsoft (or me) and should only be used at your own risk if you want to fancy up your Resource Explorer icons similar to how Flo tricked out her name tag on those insurance commercials on TV.

If you want to change the icon that is displayed for a particular inventory class, you need to pop open the managementclassdescriptions.xml file and change some .xml (make sure you back up the original first!). For this example, I just opened it with notepad.exe and scrolled down until I found the class I wanted to modify. In this example I'm using the CD-ROM class and the snippet in the .xml about it looks like this:

<ManagementClassDescription Name="SMS_G_System_CDROM" SuperclassName="SMS_G_System_Current">
  <ResourceAssembly>
    <Assembly>AdminUI.UIResources.dll</Assembly>
    <Type>Microsoft.ConfigurationManagement.AdminConsole.UIResources.SMS_G_System_CDROM.resources</Type>
</ResourceAssembly>
<ImagesDescription>
<ResourceAssembly>
<Assembly>AdminUI.UIResources.dll</Assembly>
   <Type>Microsoft.ConfigurationManagement.AdminConsole.UIResources.Properties.Resources.resources</Type>
</ResourceAssembly>
<ImageResourceName>System</ImageResourceName>
</ImagesDescription>
<Properties>
    <ManagementClassPropertyDescription Name="Availability" Type="Integer" />
    <ManagementClassPropertyDescription Name="Description" />
    <ManagementClassPropertyDescription Name="DeviceID" />
    <ManagementClassPropertyDescription Name="Drive" />
   <ManagementClassPropertyDescription Name="GroupID" Type="InvariantInteger" />
<ManagementClassPropertyDescription Name="Manufacturer" />
    <ManagementClassPropertyDescription Name="MediaType" />
   <ManagementClassPropertyDescription Name="Name" />
    <ManagementClassPropertyDescription Name="ResourceID" Type="InvariantInteger" />
    <ManagementClassPropertyDescription Name="RevisionID" Type="InvariantInteger" />
   <ManagementClassPropertyDescription Name="SCSITargetID" Type="InvariantInteger" />
    <ManagementClassPropertyDescription Name="SystemName" />
    <ManagementClassPropertyDescription Name="TimeStamp" Type="DateTime" />
<ManagementClassPropertyDescription Name="VolumeName" />
</Properties>
</ManagementClassDescription>

There's a lot of information there, but we're really only concerned with the <ImagesDescription> section:

<ImagesDescription>
<ResourceAssembly>
<Assembly>AdminUI.UIResources.dll</Assembly>
<Type>Microsoft.ConfigurationManagement.AdminConsole.UIResources.Properties.Resources.resources</Type>
</ResourceAssembly>
<ImageResourceName>System</ImageResourceName>
</ImagesDescription>

See how the image description says to go look in the AdminUI.UIResources.dll file and grab the icon named System to display for the CD-ROM class in Resource Explorer? Luckily, the icons are listed in the .xml as names and not ID's so we don't have to open the .dll and poke around to find an icon we like, we can just peruse the .xml for a name that sounds like something we're after…how about CD_Rom? Changing System to CD_Rom for that <ImageResourceName> line, saving the .xml, and then restarting Resource Explorer returns this result:

Before: After:

That's better, and now you know how to change the default icons in Configuration Manager's version of Resource Explorer.

Adding custom icons is a bit more problematic. If you open the AdminUI.UIResources.dll file in Visual Studio, the icons are not listed the same way as they were in the SMS_RES1.dll file (the SMS 2003 .dll holding the icons) and you also can't add custom icon resources to that file. To add your own custom icons in Configuration Manager, you have to create a new .dll file, add your icon to that file, and then properly reference your custom assembly and icon name in the managementclassdescriptions.xml file.

That seems just a little bit too complicated to me to throw in at the end of this blog post and I'll have to write that up seperately. So, until then, that's all I've got to say about changing Configuration Manager 2007 Resource Explorer icons.

~Jeff

Customizing SMS 2003 Resource Explorer Icons

jgilbert — Sat, 14 Mar 2009 01:03:00 GMT

I've done quite a bit of hardware inventory modifications in my time and while it's great to see the new information displayed in Resource Explorer, it has always kind of bothered me that the new classes always had the default icon while some of the other inventoried information had more descriptive, and lets face it, cooler looking icons. As I implemented more and more hardware inventory modifications, it also became a challenge for me to remember just how I pulled that information—was it a registry key, a NOIDMIF, a script…you get the idea. Wouldn't it be nice to have a custom icon to remind me where that data came from I thought. This issue would crop up every now and then which sent me on a wild goose chase looking around for a while on the net. I never really came across anything very helpful and eventually I'd move on to something else. While this is seemingly very minor issue, it has always bothered me that I couldn't figure it out. And then one fatefully day recently someone on the myITforum SMS e-mail list (subscribe here) had a problem that caused the non-default SMS 2003 Resource Explorer icons to revert to the standard default icons. Now my quest to change Resource Explorer icons had taken on new life, and actually had a basis in something useful in helping out someone, so it wasn't just a matter of me trying to do something cool in figuring this out.

Important: Before reading on, understand that the information in this post is in no way supported by Microsoft (or by me in general for that matter) and should only be used at your own risk. If you're not comfortable mucking about with the steps in this procedure and performing icon disaster recovery in the event something goes wonky, please do not attempt! If your icons are not broken and you aren't after the cool icon effects for whatever reason then it's probably not worth the risk.

Disclaimer out of the way, here's the good stuff. To understand how SMS 2003 decides which icon to display for hardware inventory information displayed in Resource Explorer, you need to have a clear understanding of the three pieces of this puzzle: the sms_res1.dll file, the sms_schm.mof file, and how this information is stored in WMI on the site server.

The sms_res1.dll file contains all of the icons that can be displayed by default, and is located in the <install drive>:\SMS\bin\i386 directory. This file contains around 300 icons and some other assorted information that I'm not going to talk about here because it's just not relevant. If you open up the .dll in Visual Studio you'll see something like the below snippet, and if you then expand the icon node, you'll see the list of icons that it is possible to pick and choose from when using a standard icon:

The sms_schm.mof file is used to map each of the hardware inventory classes displayed in Resource Explorer to a specific icon stored within the sms_res1.dll file. It also lives in the <install drive>:\SMS\bin\i386 directory. Here you can see the part of the file where the CD-ROM information is assigned icon #316 in the SMS_RES1.dll file:

The sms_schm.mof file stores mapped icon information for inventory classes in the IconDLL and IconID qualifiers for their respective WMI namespaces under root\sms\site_<site code> when it is compiled. You can see in the snippet below that the CD-ROM class is set to display icon #316 (the CD-ROM icon) in WMI and as stored in the SMS_RES1.dll file:

If you're looking in SMS 2003's Resource Explorer and see only the default icon for everything, then one of those three pieces has gone catawompus. To find the culprit, you can run a cursory visual check of the files to see if something has become corrupted. If it all looks OK, then back up all of these files to somewhere safe and recompile the sms_schm.mof file by opening up a command prompt, navigating to the directory that sms_schm.mof is located and then running this command: MOFCOMP sms_schm.mof. Restart the computer and Resource Explorer should be back to displaying the default, 'non-default' icons for those classes lucky enough to have been assigned one. If it isn't, then you might need to grab another copy of the sms_schm.mof file and/or sms_res1.dll file from the installation source files and try again. If that doesn't work, then your WMI might be corrupt or some other issue beyond the abilities of a blog post to help you and you need to burn a support call.

That issue resolved and out of the way, I decided that I would continue on my quest for custom icons in Resource Explorer. If all of the Resource Explorer icons are stored in the sms_res1.dll file and are called by the sms_schm.mof file then what's to stop me from changing a default icon to one of the other icons stored in the sms_res1.dll file? For that matter, what's to stop me from adding my own custom icons? Turns out, nothing lucky enough for me.

First things first, you need to find the icon that you want to use and it's associated IconID as listed in sms_res1.dll. To do this, you'll need to use Visual Studio to pop open the sms_res1.dll file and then poke around until you see an icon that you like. Take the icon's IconID (the number of the icon in the .dll), change the appropriate class IconID value in the sms_schm.mof file accordingly, and then recompile it.

That's great for pre-existing inventory classes, but what if you want to change the icon for a custom inventory class? No problem, just open up the sms_schm.mof file and add in a section at the bottom for your class. Below is the addition I made for the custom physical memory MOF edit to my sms_schm.mof file and you can use it as a template, just ensure the group name and class information matches your custom MOF edit:

[
SMS_Group_Name("Physical Memory"),
IconID(306),IconDLL("SMS_RES1.dll"),
SMS_Class_ID("MICROSOFT|PHYSICAL_MEMORY|1.0")]

Class Win32_PhysicalMemory : SMS_Class_Template
{};

Having the custom physical memory class information displayed using one of the default icons is OK, but wouldn't it be nice to have the icon actually look like RAM? Easy enough, just add the snippet above for the class to the sms_schm.mof file and change the class IconID property to display the RAM icon as stored in sms_res1.dll (IconID: 306). Recompile the sms_schm.mof file on the site server and hopefully the icons change the next time you open or refresh Resource Explorer. If not, restart the server and then here's what you should see in Resource Explorer (before and after):

Before: After:

Cool eh?

Using one of the predefined icons is handy, but if you don't see an icon that you like stored in sms_res1.dll, or you want to add your own custom icon for whatever reason, that's easy to do too. Using Visual Studio again, open up the sms_res1.dll file and add the icon of your choice to the file and save it. To do that, open the .dll in Visual Studio, right-click the Icon node, select Add Resource, ensure Icon is selected and then click Import. Browse to your favorite icon file and click open to add it. The new icon will appear in the list with an assigned ID and be highlighted in a box so you know which one you just added (remember the new IconID number!).

Next, make the appropriate changes to the sms_schm.mof file and compile it (MOFCOMP <path>\sms_schm.mof). Custom icons allow you to verify which classes are custom MOF edits and/or know where the custom class information came from depending on which icon you've decided upon for specific MOF editing techniques (registry, WMI, script, etc…). For example, this one came from a registry key:

Oops. That's not a registry icon (and didn't come from the registry either, but I'm using some poetic license here)! The registry icon is a default icon in the sms_res1.dll and wasn't very interesting to me, while Bill the Cat is one of my personal hero's. OK, kind of off-topic there, but it shows how you can use any icon that you want to and besides, couldn't the world use more Bill the Cat?

If you'd like to make an icon change, but don't want to permanently modify the sms_schm.mof file, then you can just go directly into WMI for that class and change the IconID to something more to your liking. If a class doesn't have the IconDLL or IconID qualifiers (both are required), just add them, but remember that recompiling the default sms_schm.mof file will result in the class displaying its original icon in Resource Explorer. Also know that at the top of the sms_schm.mof file is the #pragma autorecover command. That means if WMI is rebuilt on the site server for whatever reason, and you haven't made your changes in that mof file, the icons will all revert back to their installation defaults when the sms_schm.mof file is recovered.

So, there you go, mystery solved—for SMS 2003 sites. Don't even think about trying to use this post as a guide to change Resource Explorer icons for a Configuration Manager 2007 site as the process isn't exactly the same, but don't worry; I've got you covered on how to do that in another blog post that's coming soon.

~Jeff

Automating IIS 7 Installation to Support Configuration Manager 2007

jgilbert — Thu, 05 Mar 2009 07:45:00 GMT

If you've ever installed, or even thought about installing, a Configuration Manager site, or site system requiring IIS on a Windows Server 2008 computer then you've probably had a look at the How to Configure Windows Server 2008 for Site Systems help topic in the Configuration Manager 2007 Documentation Library and then spent some time installing and manually configuring IIS 7, then installing WebDAV for IIS 7, and then spent some more time configuring WebDAV afterwards. If you only have to do this one or two times it's not too big of a deal, but because I'm constantly installing Configuration Manager lab machines on Windows Server 2008, going through the motions of installing and configuring IIS 7 can get repetitive. Not to mention that I always seem to leave out a bit of the configuration that sends me back to installing a missing feature later. After about the thousandth time configuring IIS 7 manually, I thought to myself "there's got to be a way to script this and save some time". If you've had the same thought then this post is for you. After some looking around, I couldn't find the steps to install and configure IIS 7 to support Configuration Manager installations anywhere so I decided to just figure it out for myself (and consequently, for you as well ).

My first stop was figuring out how to install IIS 7 via the command line. Instead of using sysocmgr (used to install IIS 6), Windows Server 2008 has a handy server manager command-line tool that is used to install Windows Server 2008 roles and features (could be any role or feature you want and not just IIS btw). If you want to install a single role or feature then you can just use the command line, but when you need to install multiple roles or features, you have to create an .xml answer file. Sounds a little daunting, but it's really not too bad. I just used notepad to create an answer file using these instructions. I covered all of the requirements defined in the Windows Server 2008 How To topic in the documentation library for every possible requirement other than the last bit about modifying the requestFiltering section on BITS-enabled distribution point computers. Here's what I came up with:

To kick off the IIS installation using just the answer file, open a command prompt (right-click command prompt and select run as administrator) and then enter a command in the format below. I saved the log file as a .log instead of a .txt so I could use SMS Trace to watch the IIS installation action progress in the log instead of the counter in the command shell window, but you don't have to):

ServerManagerCmd.exe -inputPath <answer.xml [-logPath <log.txt>]

After running that command, you should see something similar to this:

Moving along to WebDAV which I thought was going to be a bit more of a challenge. Not only do you need to install the applicable version of WebDAV (either x86 or x64), you also need to create an authoring rule and configure other settings post installation. Luckily, another tool came to my rescue: appcmd.exe. This tool allows you to configure IIS 7 settings from the command-line…handy.

Armed with an IIS 7 installation answer file and the servermanagercmd and appcmd tools, I was ready to write the script to automate the process. I also wanted the script to auto-generate the IIS 7 answer .xml file for me so I wouldn't have to carry around an extra file everywhere (those .xml files can get heavy and I'm not as young as I used to be). Before I get to the script though, here are some caveats if you're planning on using my script 'as is':

The script relies on having the applicable WebDAV installation .msi in the same directory that the script is started from (in my testing I put the script at the root of C:\ and used the x86 version)
The script assumes that everything is installed on the C:\ so if you're using a different drive you'll need to tweak the script as necessary
There is no error checking in the script as I am only planning on using this in my lab for clean installations
You can't use this script if you've already installed IIS 7 as it will fail to reconfigure IIS
This script is provided 'as is', your mileage may vary, test it in a lab to ensure it does everything you need it to before using it in production, etc...

So without much futher adieu, here's the PowerShell script…what? Don't have powershell installed on your Windows Server 2008 computer? No problem, just do this, open a command prompt (run as administrator) and run: ServerManagerCmd –install powershell and then continue after PowerShell installs. To run the .ps1 you'll also need to relax the PowerShell script execution policy since this script won't be signed. To do that, open up PowerShell and run Set-ExecutionPolicy Unrestricted. This setting will allow you to run unsigned scripts, but will also lower security for running scripts unless you change the security setting to a higher level later.

OK, moving on, here come the scripts. I've shown how to do this using PowerShell, .vbs, and .bat, but I do not recommend C&P'ing these scripts as who knows what word-wrap as done to them. If you want to use these scripts, you should probably download the .zip containing all of them from here. The .zip contains the un-commented PowerShell (IIS7.ps1), visual basic script (IIS7.vbs), and a batch file (IIS7.bat) that all do the same thing except that you have to manually create the answer.xml file yourself when using the .bat.

Here's the PowerShell version. I've inserted comments in this post to tell you what is going on as the script progresses:

# All the write-output stuff is just to make the console output look nice
write-output ""
write-output "Creating IIS answer file"
# The next line creates the IIS 7 answer file named answer.xml located at the root of C:\ (where the script was started from). Out-null is my attempt to make PowerShell wait before moving on until this process completes
new-item -path C:\ -name answer.xml -type 'file' | out-null
# These add-content lines are used by PowerShell to write the answer.xml file with the required role and role services Id's
add-content -path answer.xml -value '<ServerManagerConfiguration'
add-content -path answer.xml -value 'Action="Install"'
add-content -path answer.xml -value 'xmlns="http://schemas.microsoft.com/sdm/Windows/ServerManager/Configuration/2007/1">'
add-content -path answer.xml -value '    <Role Id="Web-Server"/>'
add-content -path answer.xml -value '    <RoleService Id="Web-Asp-Net"/>'
add-content -path answer.xml -value '    <RoleService Id="Web-ASP"/>'
add-content -path answer.xml -value '    <RoleService Id="Web-Windows-Auth"/>'
add-content -path answer.xml -value '    <RoleService Id="Web-Metabase"/>'
add-content -path answer.xml -value '    <RoleService Id="Web-WMI"/>'
add-content -path answer.xml -value '    <Feature Id="BITS"/>'
add-content -path answer.xml -value '    <Feature Id="RDC"/>'
add-content -path answer.xml -value '</ServerManagerConfiguration>'
write-output ""
# Here are the commands that write the script's progress to the command shell, use the newly created answer.xml file to install IIS 7, and write installation progress to c:\iisinstall.log
write-output "Installing IIS 7"
ServerManagerCmd.exe -inputPath c:\answer.xml -logPath c:\IISInstall.log | out-null
# This line just deletes the answer.xml file after ServerManagerCmd has finished with it
remove-item c:\answer.xml
write-output ""
# These lines write the script's progress to the command shell and run the applicable WebDAV installation command line
write-output "Installing WebDAV for IIS 7"
msiexec /i webdav_x86_rtw.msi /qn | out-null
write-output ""
# These lines write the script's progress to the command shell and use appcmd.exe to enable WebDAV
write-output "Enabling WebDAV"
c:\windows\system32\inetsrv\AppCmd.exe set config "Default Web Site/" /section:system.webServer/webdav/authoring /enabled:true /commit:apphost | out-null
write-output ""
# These lines write the script's progress to the command shell and use appcmd.exe to create and configure the required WebDAV authoring rule
write-output "Creating and configuring a WebDAV authoring rule"
c:\windows\system32\inetsrv\AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoringRules /"+[users='*',path='*',access='Read']" /commit:apphost | out-null
write-output ""
# These lines write the script's progress to the command shell and use appcmd.exe to configure the remaining required WebDAV properties
write-output "Configuring WebDAV"
write-output ""
write-output "    Allowing access to hidden files"
c:\windows\system32\inetsrv\AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /fileSystem.allowHiddenFiles:true /commit:apphost | out-null
write-output "    Allowing anonymous property queries"
c:\windows\system32\inetsrv\AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /properties.allowAnonymousPropfind:true /commit:apphost | out-null
write-output "    Not allowing Custom properties"
c:\windows\system32\inetsrv\AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /properties.allowCustomProperties:false /commit:apphost | out-null
write-output "    Allowing property queries with infinite depth"
c:\windows\system32\inetsrv\AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /properties.allowInfinitePropfindDepth:true /commit:apphost | out-null
write-output "    Allowing hidden files to be listed"
c:\windows\system32\inetsrv\AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /fileSystem.allowHiddenFiles:true /commit:apphost | out-null
write-output ""
write-output ""
# These lines aren't really necessary, but I like the script to pause so I can ensure that it finished. It's also a cool reminder of how to do a .bat-style pause in PowerShell
Write-Host "Press any key to continue ..."
$x = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
exit

If all goes well, when you run the script you should see something like this:

Here's the same thing in vbscript:

wscript.echo ""
wscript.echo "Creating IIS 7 answer file"
wscript.echo ""
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFile = objFSO.CreateTextFile("C:\answer.xml")
    objFile.WriteLine "<ServerManagerConfiguration"
    objFile.WriteLine "Action= " & chr(34) & "Install" & chr(34) & ""
    objFile.WriteLine "xmlns= " & chr(34) & "http://schemas.microsoft.com/sdm/Windows/ServerManager/Configuration/2007/1" & chr(34) & ">"
    objFile.WriteLine "    <Role Id=" & chr(34) & "Web-Server" & chr(34) & "/>"
    objFile.WriteLine "    <RoleService Id=" & chr(34) & "Web-Asp-Net" & chr(34) & "/>"
    objFile.WriteLine "    <RoleService Id=" & chr(34) & "Web-ASP" & chr(34) & "/>"
    objFile.WriteLine "    <RoleService Id=" & chr(34) & "Web-Windows-Auth" & chr(34) & "/>"
    objFile.WriteLine "    <RoleService Id=" & chr(34) & "Web-Metabase" & chr(34) & "/>"
    objFile.WriteLine "    <RoleService Id=" & chr(34) & "Web-WMI" & chr(34) & "/>"
    objFile.WriteLine "    <Feature Id=" & chr(34) & "BITS" & chr(34) & "/>"
    objFile.WriteLine "    <Feature Id=" & chr(34) & "RDC" & chr(34) & "/>"
    objFile.WriteLine "</ServerManagerConfiguration>"
objFile.Close
Set wshShell = CreateObject("Wscript.Shell")
wscript.echo "Installing IIS 7"
wshShell.Run "ServerManagerCmd.exe -inputPath c:\answer.xml -logPath c:\IISInstall.log", 0, true
wscript.echo ""
wscript.echo "Installing WebDAV for IIS 7"
wshShell.Run "msiexec /i webdav_x86_rtw.msi /qn", 0, true
Set wshShell = CreateObject("Wscript.Shell")
wscript.echo ""
wscript.echo "Enabling WebDAV"
wshShell.Run "c:\windows\system32\inetsrv\AppCmd.exe set config " & chr(34) & "Default Web Site/" & chr(34) & " /section:system.webServer/webdav/authoring /enabled:true /commit:apphost", 0,
true
wscript.echo ""
wscript.echo "Creating and configuring a WebDAV authoring rule"
wshShell.Run "c:\windows\system32\inetsrv\AppCmd.exe set config " & chr(34) & "Default Web Site/" & chr(34) & " /section:system.webServer/webdav/authoringRules /+[users='*',path='*',access='Read'] /commit:apphost", 0, true
wscript.echo ""
wscript.echo "Configuring WebDAV"
wscript.echo ""
wscript.echo "    Allowing anonymous property queries"
wshShell.Run "c:\windows\system32\inetsrv\AppCmd set config " & chr(34) & "Default Web Site/" & chr(34) & " /section:system.webServer/webdav/authoring /properties.allowAnonymousPropfind:true /commit:apphost", 0, true
wscript.echo "    Not allowing Custom properties"
wshShell.Run "c:\windows\system32\inetsrv\AppCmd set config " & chr(34) & "Default Web Site/" & chr(34) & " /section:system.webServer/webdav/authoring /properties.allowCustomProperties:false /commit:apphost", 0, true
wscript.echo "    Allowing property queries with infinite depth"
wshShell.Run "c:\windows\system32\inetsrv\AppCmd set config " & chr(34) & "Default Web Site/" & chr(34) & " /section:system.webServer/webdav/authoring /properties.allowInfinitePropfindDepth:true /commit:apphost", 0, true
wscript.echo "    Allowing hidden files to be listed"
wshShell.Run "c:\windows\system32\inetsrv\AppCmd set cconfig " & chr(34) & "Default Web Site/" & chr(34) & " /section:system.webServer/webdav/authoring /fileSystem.allowHiddenFiles:true /commit:apphost", 0, true
wscript.echo "    Allowing access to hidden files"
wshShell.Run "c:\windows\system32\inetsrv\AppCmd set config " & chr(34) & "Default Web Site/" & chr(34) & " /section:system.webServer/webdav/authoring /fileSystem.allowHiddenFiles:true /commit:apphost", 0, true
wscript.echo ""
wscript.echo ""
Set wshShell = Nothing
wscript.quit

…and again as a .bat file (create the answer.xml file in the same directory before running)

@ECHO OFF
Echo Installing IIS 7
start /wait ServerManagerCmd.exe -inputPath c:\answer.xml -logPath c:\IISInstall.log
Echo Installing WebDAV for IIS 7
start /wait msiexec /i webdav_x86_rtw.msi /qb
cd %Windir%\system32\inetsrv
Echo Enabling WebDAV
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /enabled:true /commit:apphost
Echo Configuring WebDAV
Echo Creating and configure a WebDAV authoring rule
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoringRules /+[users='*',path='*',access='Read'] /commit:apphost
Echo Allowing anonymous property queries
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /properties.allowAnonymousPropfind:true /commit:apphost
Echo Allowing Custom Properties
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /properties.allowCustomProperties:false /commit:apphost
Echo Allowing property queries with infinite depth
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /properties.allowInfinitePropfindDepth:true /commit:apphost
Echo Allowing hidden files to be listed
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /fileSystem.allowHiddenFiles:true /commit:apphost
Echo Allowing access to hidden files
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /fileSystem.allowHiddenFiles:true /commit:apphost
pause
@ECHO ON
exit

Hopefully this helps get you going with Configuration Manager installations on Windows Server 2008 computers a little faster!

~Jeff

Want to have the most recent ConfigMgr help available without needing an Internet connection to read it?

jgilbert — Wed, 04 Feb 2009 22:50:00 GMT

No, we still haven't found a way to make such a large documentation set easily printable, but now you can download the Configuration Manager help file locally and also update the help installed on Configuration Manager consoles so that it can be nearly as up to date as the help displayed on the Web. More information about it can be found here:

http://blogs.technet.com/configmgrteam/archive/2009/02/03/need-the-latest-configuration-manager-2007-help-file.aspx

(this also explains why I haven't been blogging in a while as I've been in VB .NET land)

~Jeff

The System Center Online catalog is now fully operational!

jgilbert — Tue, 11 Nov 2008 02:09:00 GMT

Dan Boldo has updated the TechNet Asset Intelligence forum with some great information--the System Center Online catalog is now fully operational. This means that if you have deployed Configuration Manager 2007 SP1, your Asset Intelligence synchronization point site system role can now be used to synchronize with System Center Online to download (and upload if you want) software catalog information!

Read on for more information here:

http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=4081162&SiteID=17

~Jeff

Deploying SQL Server 2005 with SP2 Using an OSD Task Sequence (Part 2)

jgilbert — Fri, 31 Oct 2008 01:33:00 GMT

The first thing that you need to do before deploying SQL Server 2005 and SQL Server 2005 SP2 using a task sequence is to create the packages and programs that the task sequence will use. If you haven't done that yet, go read part 1 of this post!

After the required packages and programs are created, and successfully distributed to distribution points, we can get started. I'm going to break this post down into the following sections:

Creating the task sequence
Advertising the task sequence
Monitoring the task sequence actions
Verifying the install did what it was supposed to

Creating the task sequence

The package source is just the SQL Server 2005 RTM installation media. The interesting bits are all in the program properties.

Navigate to the Task Sequences node in the Configuration Manager console (System Center Configuration Manager \ Computer Management \ Operating System Deployment\Task Sequences). Right-click Task Sequences and select New\Task Sequence to start the New Task Sequence Wizard.
1. Select the Create a new custom task sequence option.
2. Type a name for the task sequence, give it a comment if you want to, and click Next—don't select a Boot image (I named mine Install SQL Server 2005 w/SP2).
3. Click Next on Summary page, let the wizard finish, and then click Close on the Confirmation Page. The new task sequence should appear in the results pane.
Right-click the task sequence you just created and click Edit.
In the Task Sequence Editor, click Add and select New Group. Give the group a name (I named mine Install SQL Server 2005 w/SP2).
Highlight the top group name and click Add\New Group. Give this subgroup a name (I named mine Install SQL Server 2005).
Highlight that group name, and then click Add\General\Install Software. You should see an install software task with a red X now (it will remain red X'd until you select a package and program to run).
1. Name the Install Software task (I named mine Installing SQL Server 2005).
2. Leave Install a single application selected. Click the Browse button and select the package that you want to use and then select the program that you want to deploy (this is the package/program that installs SQL 2005 RTM for me). The red X should now be a green check mark.
Highlight the install software task and click Add\General\Restart Computer.
Highlight the top group name again and click Add\New Group. Give this subgroup a name (I named mine Install SQL Server 2005 SP2). Drag the new group underneath the previously created task sequence group.
Highlight that group name, and then click Add\General\Install Software.
1. Name the Install Software task (I named mine Installing SQL Server 2005 SP2).
2. Leave Install a single application selected. Click the Browse button and select the package that you want to use and then select the program that you want to deploy (this is the package/program that installs SQL 2005 SP2 for me). The red X should now be a green check mark.
Highlight the install software task and click Add\General\Restart Computer.

If all goes well, you should now see something like this screen shot in the Task Sequence Editor Window and you can save and close it:

Advertising the task sequence

Of course, task sequences do no good if you don't advertise them to clients.

Right-click the newly created task sequence and select Advertise to start the New Advertisement Wizard.
Ensure the correct task sequence is selected and click Browse to select the collection that you want to advertise this task sequence to. If you don't want this advertisement to include subcollections (I don't), then de-select the Include members of subcollections option.
On the Schedule page, configure the schedule that you want this advertisement to use. Because I'm doing this in a lab and I want it to install right now (or as close to it as possible), I create a mandatory assignment time for as soon as possible. I also check the options to Ignore maintenance windows when running this program and Allow system restart outside of maintenance window.
On the Distribution Points page, you need to select an option for how the package contents will be accessed. Because I like to ensure that all required files are present before beginning major software installations to avoid transient network issues during installation that could cause the install to fail, the two options I'm looking at are: Download all contents locally before starting task sequence and Download content locally by running task sequence. From those two available choices, I'm going to pick Download content locally by running task sequence and here's why:

When you configure an advertisement to Download all contents locally before starting task sequence, the content is stored here in the client cache directory—and they are not deleted after the task sequence finishes:	When you configure the task sequence advertisement to Download content locally by running task sequence, the content is stored in a temporary task sequence directory—and they are deleted when the task sequence finishes:

Technically, the install will run successfully using files from either location (and most likely even if you run it from a distribution point), but the problem I have with using the client's local cache directory is that the source files are not removed after installation. Even though I'm using a setup.ini file located on a hidden share and not located with the source files in this instance, you might not always do that and a savvy user could get ahold of those cached SQL Server setup files, proceed to run amok on the network, and then I've got a bunch of unauthorized SQL installations to account for. Besides that, it just takes up a bunch of hard drive space on clients unnecessarily (over a gigabyte in this case for SQL Server 2005 and SP2).

On the Interaction page, select Show the task sequence progress.
Finish out the wizard to complete the advertisement process.

Now, you can just wait until the targeted computer retrieves the machine policy that contains the advertisement information for the task sequence to kick off, but I'm not that patient so I manually initiate a machine policy retrieval & evaluation cycle to get the party started.

Monitoring the task sequence actions

There are a couple of ways to monitor the task sequence as it goes through the motions that you have configured for it. You can use the Configuration Manager console and reports to view the status of the task sequence execution or you can watch the progress from a targeted machine…or both I suppose. I'll walk you through each of these methods next.

Monitoring task sequence execution from the Configuration Manager console

As soon as you advertise the task sequence to a collection, the Configuration Manager console OSD home page updates and displays the status of the new task sequence advertisement:

As the task sequence execution proceeds, clients send in task execution status messages, and the home page refreshes, you can follow the status in the console using the color coded chart:

If you don't want to wait, or you want to see an individual computer's task sequence execution progress, you can view Web reports that detail the progress by clicking the task sequence name in the console. There are a total of three reports that drill down and display more detailed information about the task sequence status:

Status summary of a specific task sequence advertisement. This report shows the status summary of all resources that have been targeted by an advertisement.

Drilling down by clicking an execution state value you get:

All system resources for a specific task sequence advertisement in a specific state. This report will show a list of computers that are targeted by the specific task sequence advertisement and are currently in the specified state.

Click a computer name for that particular computer's status gets you:

History – Specific task sequence advertisements run on a specific computer. This report shows the status for each step of a task sequence. If no record is returned, it means the task sequence has not yet started.

The last one is the one that I like. It displays detailed information about each step taken during the task sequence execution for a particular computer. I like to open this report for a test computer and watch the actual task sequence in action by refreshing the page every now and then. Of course, nothing beats watching the task sequence execution at an actual computer that is running it though.

Monitoring task sequence execution from the client computer

After a client computer receives the task sequence notification policy it displays the notification in the system tray to alert you that it is going to run (I set a mandatory installation time of as soon as possible for this example):

You can follow the progress of these initial stages by watching the client's execmgr.log which hands off logging to the <install dir>\CCM\Logs\SMSTSlog\smsts.log file. Anyway, clicking the notification gives you the option to run the task sequence or wait for the countdown to complete. When the task sequence starts, installation progress messages are displayed on the screen.

The install software task (to install SQL Server 2005):

The restart computer task that comes after the install software task in the task sequence:

After the computer restarts, the task sequence waits for the Configuration Manager client to reinitialize and then continues on its merry way:

The install software task to install SQL Server 2005 SP2:

The restart computer task that comes after the install software task in the task sequence and we're all done:

Verifying the task sequence did what it was supposed to

The OSD home page gives you a good overall view of the task sequence status and by viewing the Web reports you can even more detailed information about whether or not the task sequence was successful. This part is just verifying that the task sequence did what it was supposed to do—install SQL Server 2005 and then SQL Server 2005 SP2.

On the targeted computer, open up SQL Server Management Studio (it is there now right?!), right-click the server name and click Properties. The General page of the server properties should look something like this:

Here you can verify some of those setup.ini file settings that we told SQL setup to use, and ensure that SP2 was successfully installed—the version number should be 9.00.3042.00. If it says something like 9.00.1399.06 (SQL Server 2005 RTM) then you know the service pack installation didn't stick. Here's a handy link while I'm thinking about it: How to identify your SQL Server version and edition.

You should also check the SQL Server setup and service pack setup summary logs. If you used my .ini file, then these logs are at the following locations respectively:

%Program Files%\Microsoft SQL Server\90\Setup Bootstrap\LOG\Summary.txt
%Program Files%\Microsoft SQL Server\90\Setup Bootstrap\LOG\Hotfix\Summary.txt.

And that is that. This is just one example of how to use task sequences to install software outside of normal OSD tasks, but I hope it has been helpful and gets you thinking of other ways that you can use this powerful new feature of Configuration Manager. Happy task sequencing!!!

~Jeff

Deploying SQL Server 2005 with SP2 Using an OSD Task Sequence (Part 1)

jgilbert — Fri, 31 Oct 2008 01:01:00 GMT

One of the coolest features (I think) of Configuration Manager is the ability to deploy software using task sequences, but because task sequences are generally associated with operating system deployment, a lot of people never really use them unless they're deploying new operating systems. Because of that, I thought I'd write up a few posts on how to use task sequences to install software, when not deploying operating system images, to kind of highlight the things you can do with it.

If you're not familiar with task sequences, then you should probably go check this link out first: About Task Sequences

One important paragraph in that topic that relates to this post is:

Although task sequences are essential for operating system deployment, they can also play a vital role in other Configuration Manager 2007 tasks. The power of task sequences lies in their flexibility and administrators can use these to configure client settings, distribute software, update drivers, edit user states, and perform other tasks independent of operating system deployment.

I install Configuration Manager site hierarchies all the time in my lab, and one of the prerequisites for installing a Configuration Manager 2007 primary site is a supported version of SQL Server to host the site database. Installing SQL Server 2005, and then SP2 on top of that, usually takes up a good bit of time and requires a few reboots so I thought this would be a good example to use. I also do most of my installations using scripted installation methods and finding a SQL setup.ini file to use to support Configuration Manager specific requirements was also hard for me to do so I've included that in this post as well.

One thing to take note of here is that task sequences that install software run normal Configuration Manager software distribution package programs and that's what the remainder of this post is about—creating the required packages and programs to install SQL Server 2005 and SQL Server 2005 SP2. These packages and programs can be advertised outside of OSD task sequences and will run just fine. Of course, you're probably now wondering why I'm writing a whole post about creating packages and programs and then using a task sequence to deploy them instead of normal software distribution. Here are a couple of reasons why:

The installation process is fully automated—including rebooting the computer. Chaining software distribution installations that require the computer to reboot is just generally not fun. Task sequences handle planned reboots with ease and ensure that all files are installed correctly with no files from a previous installation still requiring a reboot.
The entire task sequence installation is easily tracked. Each step along the way is viewable in Web reports and the overall status of the task sequence is displayed in the operating system deployment home page in the console.
The package source files are not leftover on the client machine after the task sequence runs (this depends on an advertisement setting that I talk about in part 2).
…and probably more things that I can't think of right now, but the above reasons are enough for me anyway.

The first thing that you need to do before deploying SQL Server 2005 and SQL Server 2005 SP2 using a task sequence is to create the packages and programs that the task sequence will use. This part is fairly straightforward software distribution stuff so I'm not going to go into much detail except to point out the important parts.

NOTE: Before using these programs to install software using a task sequence, ensure that you have tested them running as normally advertised programs. When programs run as part of a task sequence, user interaction is generally not possible. This means that if an error or warning dialog pops-up that you can't see, the task sequence will fail without completing the installation, and you'll have a hard time figuring out why!

Creating the SQL 2005 Package

The package source is just the files from the SQL Server 2005 RTM installation media that I've stored in a server share on my site server computer. The interesting bits are all in the program properties.

General Tab

First, there's the command line that I'm using that requires some explanation:

Servers\setup.exe /settings \\siteserver\sql$\SetupSQL.ini /qb

The actual setup.exe file is located in the Server subdirectory of the installation source files and I'm using the SQL Server setup /settings command line option to specify a setup.ini file for SQL Setup to use when during installation. Because you have to specify a complete path to the .ini file, and determining what that path will be at runtime can be difficult (especially when deploying through a task sequence), I've decided to use a hidden share on the site server to host the .ini file. That way, I always know where the .ini file is, and I can change it as required from a central location later without having to change the package source files. Another good reason to do this is because you don't want just anyone finding the source files and also getting the installation product key at the same time unless you like a lot of unplanned SQL installationsJ.

About the .ini file settings that I'm using

I looked around for a example of a SQL Server setup.ini file and couldn't find one that completely fit my requirements for installing SQL to support Configuration Manager so I made my own. I decided to just install everything that I thought I might ever need all the way up to Configuration Manager 2007 R2 installations.

The .ini file I'm using is here (rename the extension from .txt to .ini before using), but specifically, the .ini file does this:

I'm not specifying an installation key as the media that I'm using doesn't require it (not that I'd show you the key I used anyway!)
Installs SQL components to their default locations. I'm just doing this in a lab so I've commented out the installation directory options in the .ini file. If you want to change where the SQL bits are installed, just uncomment (take out the ;) and enter the locations you want to use.
The ADDLOCAL line tells SQL to install:
- SQL database components
- SQL replication bits (in case I want to play with SQL replication later)
- Reporting Server components (for SQL reporting services integration with R2)
- Client components so I can manage the SQL installation locally
- SQL tools and books online (of course you want the technical documentation right?)
Use the default instance for the installation (MSSQLSERVER)
Run all of the SQL services under local system (not a SQL Server best practice, but this is for a lab installation and I don't want to deal with setting an SPN for the account every time I use this .ini to setup SQL). I also set all the services to autostart.
Sets the collation of the installation to SQLCOLLATION=Latin1_General_CI_AS.
Configures the reporting services installation to the default configuration.
Sets the installation to use TCP/IP communication and not named pipes.
Ops out of error and SQM reporting for the instance.

Another option for this program command line could be an actual SQL Server setup command line like the one below (this is just an example command line and does not do what the .ini file I'm using does—this would all need to be on one line too):

.\Servers\setup.exe /qb INSTANCENAME=MSSQLSERVER ADDLOCAL=ALL SQLACCOUNT=""NT AUTHORITY\SYSTEM"" AGTACCOUNT=""NT AUTHORITY\SYSTEM"" SQLBROWSERACCOUNT=""NT AUTHORITY\SYSTEM"" RSACCOUNT=""NT AUTHORITY\SYSTEM"" ASACCOUNT=""NT AUTHORITY\SYSTEM"" SQLAUTOSTART=1 AGTAUTOSTART=1 ASAUTOSTART=1 RSAUTOSTART=1

Of course, that won't all fit in the command line text box in the program properties, so you'd have to write a .bat or .vbs or some other wrapper to pass the command line. Besides, setup .ini files are more TechSexy than setup command line options J

Note: If you're interested in customizing your own .ini file to use for SQL Server setup, you could take a look at the template.ini file that ships with the SQL Server setup files in the .\Servers\ directory. This template also gives command line examples and additional information about .ini file settings that I haven't talked about.

Requirements Tab

I always set the Maximum allowed run time (minutes) option to Unknown. This might cause the installation to run over maintenance windows, but if I'm going to deploy SQL Server I don't want it timing out on me and I should probably have a pretty good idea of which servers I'm sending this installation package to so I know what to expect.

Environment Tab

I set the program to: run whether or not a user is logged on, run with administrative rights, and run with UNC name.

Advanced Tab

I'm not going to advertise this program because I'm only going to deploy it through a task sequence, so I enabled the Allow this program to be installed from the Install Software Task sequence without being advertised option.

Creating the SQL 2005 Service Pack 2 Package

The package source is just the SQL Server SP2 installation file stored on the site server computer. This package is much simpler than the actual SQL Server installation package, but I'll review what I'm doing to install SP2 here.

General Tab

The command line I use for the actual SP2 installation is just a normal command line install of SP2: SQLServer2005SP2-KB921896-X86-ENU.exe /quiet /basic /allinstances.

Requirements Tab

I always set the Maximum allowed run time (minutes) option to Unknown for service pack installations so it won't time out on me. Again, this might cause the installation to run over maintenance windows, but I'm OK with that.

Environment Tab

I set the program to: run whether or not a user is logged on, run with administrative rights, and run with UNC name.

Advanced Tab

So at this point, the required packages and programs are created to install SQL Server 2005 and SP2. Now you need to make that sure that you get the packages successfully to a distribution point that you'll use to get the bits during the actual task sequence steps.

While those packages are being copied to distribution points, we can get started working on the actual task sequence that will be used to install SQL Server 2005 and SP2... but you'll have to wait for me to finish Part 2 of this post to see how to do that first!

~Jeff

Getting Required Updates on Non-Internet Connected SUPs (Part 2)

jgilbert — Wed, 29 Oct 2008 05:08:00 GMT

[BEGIN EDIT]

I've discovered something interesting that might make the remainder of this post moot.

When I installed WSUS for the SUP on the disconnected network and used the WSUS local internal database I could not use the download software updates wizard to obtain updates from the local Wsuscontent directory on the SUP (thus this post below). However, after writing the below post I did some additional testing and during WSUS installation for the disconnected SUP if I configured WSUS to use the SQL instance hosting the site database, and then approved required updates in the Internet-connected WSUS server (which downloaded them to the local wsuscontent dir on the Internet-connected WSUS), and then copied the wsuscontent dir to the WSUS installation on the disconnected network I COULD use the wsuscontent directory as the local source to download required updates.

I'm going to leave the remainder of this post here because it has some other useful information like running scripts to directly query the site database for information, but the bottom line is this:

From my additional testing after writing the below post, it seems that if you use the SQL instance to host the WSUS database on the disconnected SUP, you do not need to go through all of the effort below and can just download updates locally from a synchronized wsuscontent dir containing the updates as downloaded by WSUS.

[END EDIT]

Before you get to this point:

You need to have successfully synchronized your active SUP with the latest and greatest software updates metadata from an Internet-connected WSUS Server (see: this post).
Enabled the software updates client agent for the site.
Have clients that have run software updates scans and reported in updates as required.
Optionally, but recommended, created the v_RequiredUpdates view according to this post.

Now that you know which updates are required (part 1), you have to figure out how to get them on to the non-Internet connected software update point so you can deploy them. To do this, you can use a script to query directly against the site database. This example uses a .vbs script to write the required update source url properties stored in the site database for required updates to a .txt file. Then, on an an Internet-connected computer, that .txt file is used as a source file for another script that reads the .txt file and downloads all the updates listed in the file. After the updates are downloaded, they can then be copied somehow back to the non-Internet connected site and used as a local source to download software updates.

I'm running the query directly against the site database because the source url property is stored in a site database table and not a view. That makes it difficult to query using standard WMI scripts that go through the SMS Provider for information. I didn't want to change the site database any more than necessary so I figured that this would be the way to go, plus it's a great example of how to do it.

Note: I didn't write this script completely on my own, but instead modified one that I found here: http://www.technowledgebase.com/2007/06/12/vbscript-how-to-create-an-ado-connection-and-run-a-query/

I'm not going to post the entire script here (runSQLQuery.txt is located here for download—you'll need to modify it a little bit and rename the extension from .txt to .vbs before trying to use it), but here's what it does in a nutshell:

Connects to the site database using integrated security
Runs a query to find the source url property for required updates that haven't been downloaded yet (runs the query created in part 1)
Writes the source url properties to a .txt file called SourceURLs.txt
Displays a pop-up message box to tell you how many update source urls were written to the text file.

The only part of the script that you must change is the source database and server entries in the connection object line. Otherwise, the script will run 'as is', but if you want to change the default behavior up a little, there are really only two other lines that you will need to modify (if you choose to):

Required change(s):

objCN.Open "Provider=SQLOLEDB.1;Persist Security Info=False;Integrated Security=SSPI;Initial Catalog=SMS_XYZ;Data Source=SiteServer"
The default security settings will connect to the site database using integrated security. If you want to use a username & password to connect to SQL, then add in this after Persist Security Info=False: User ID=<account>;Password=<password>; and take out the Integrated Security part.
You also need to change the site database name (Initial Catalog), and the site database server name (Data Source) to match your requirements.

Optional changes:

strSQL="SELECT DISTINCT dbo.v_RequiredUpdates.SourceUrl FROM dbo.v_RequiredUpdates"
If you didn't create the view, you can just comment out the line about querying the view and uncomment the full SQL query. In case you missed it from part 1, here it is: (watch for word wrap, this must all be on one line when used in the script):

strSQL="SELECT DISTINCT TOP (100) PERCENT dbo.CI_ContentFiles.SourceURL FROM dbo.v_Update_ComplianceStatusAll INNER JOIN dbo.v_UpdateContents ON dbo.v_Update_ComplianceStatusAll.CI_ID = dbo.v_UpdateContents.CI_ID INNER JOIN dbo.v_UpdateInfo ON dbo.v_UpdateContents.CI_ID = dbo.v_UpdateInfo.CI_ID INNER JOIN dbo.CI_ContentFiles ON dbo.v_UpdateContents.Content_ID = dbo.CI_ContentFiles.Content_ID WHERE (dbo.v_Update_ComplianceStatusAll.Status = 2) AND (dbo.v_UpdateContents.ContentLocales = 'English' OR dbo.v_UpdateContents.ContentLocales = ' ') AND (dbo.v_UpdateInfo.IsExpired = 'False') AND (dbo.v_UpdateContents.ContentProvisioned = 0)"
strOutputFile = "SourceURLs.txt"
By default, the script will write the download location for required updates to a .txt file named SourceURLs.txt and that file name is referenced when using the download script. If you want to use a different text file name for some reason, then just change the strOutputFile value to whatever you want to call it. You'll have to remember to use the new file name for the download script too.

OK, all that out of the way, just double-click the .vbs and it should reward you with a bunch of required updates source urls written to a text file in the same directory that the script was run from and display a message similar to:

Note: Open SourceURLs.txt and backspace the last line so there is no empty line at the end. If you don't do that the download script still works correctly, but throws an error at the end when it sees the empty line.

Now it is time to take that text file (SourceURLs.txt), go to a computer with an Internet connection, and run script number two. The second script is the one that does all the hard work for you. It reads the source urls text file and downloads the updates into the same directory the script was run from. Just in case you wanted to test this, I've included a sample SourceURLs.txt file with three update download locations here.

This script came from a few hours of me banging my head against the wall trying to figure out how to do it properly and then realizing that the other side of the wall was literally the office of one of our talented SMS SDK writers…problem solved. The download script doesn't require any modifications at all other than some error logging that I didn't add into the script and it can be found here.

This time you need to open a command prompt and use the following command: cscript downloadUpdates.vbs SourceURLs.txt.

If all goes to plan after running the script, you should see something like the below screen shot and the folder the script was run in should now contain all of the downloaded updates:

Now you just need to somehow get that directory full of source files to the non-Internet connected site, share it out, and then go through your normal ConfigMgr software updates processes. When it comes time to deploy those updates, just select the option to download source files from a location on the local network and point the wizard to your local source files share:

Some random last thoughts about these posts that I've neglected to mention so far:

Why do we need these scripts? Because you can't just synchronize a WSUS Server and then sync that WSUS Server's downloaded update content with the WSUS Server hosting the SUP site role…well, you can, but you won't be able to download updates using the WSUS content files for distribution via ConfigMgr because the software updates download wizard won't recurse through the various update directories that the WSUS Server creates when it stores downloaded updates. Same goes for using a different SUP server's package source directory (another script on the back burner for me).
This technique will download all updates that clients have determined that they require through software updates scanning. You might not want to deploy every update that a client has found it requires so this might end up just using up hard drive space on your server with a bunch of unnecessary updates. Of course, you could just delete the original source directory contents after you create the deployment package, but the next time you run through this process those same updates will reappear as they're still required and haven't been downloaded yet. I figured it was better to have all the updates there just in case you ever ended up needing them than to have to go through this process all the time for smaller groups of updates. That being said, another option is to only download required updates that haven't been downloaded yet that exist in defined update lists. I'm working on that, but it has taken me a while to get to this point and to be honest I really need to get back to my day job J
These scripts are really more of an example and they'll work 'as is', but you might want to refine them as needed later on.

I hope you've found these posts (or at least some part of them) helpful and this technique gets your disconnected SUPs sync'd, and your clients patched!

~Jeff

Getting Required Updates on Non-Internet Connected SUPs (Part 1)

jgilbert — Tue, 28 Oct 2008 19:24:00 GMT

Before you get to this point:

You need to have successfully synchronized your active SUP with the latest and greatest software updates metadata and the WSUSContent directory from an Internet-connected WSUS Server (see: this post).
Enabled the software updates client agent for the site.
Have clients that have run software updates scans and reported in updates as required.

Now that you know which updates are required, you have to figure out how to get them on to the non-Internet connected software update point so you can deploy them. The first part of all of this (part 1 of this post) is to query the site database to find all the required updates that you want to download. After you get that far, you'll need to use some handy .vbs scripts to actually do all the hard work and download the updates from a remote computer with an Internet connection—that will be part 2.

Technically, you don't have to create this view, but it makes the syntax of the script to come easier with the added bonus that you can use the view to create a Web report to view more information about the required updates other than just their download location.

NOTE: If you use this view to create a Web report, don't forget to grant the webreport_approle application role the required select permissions!

Here's the query that I'm using for the view and an explanation of what I'm actually querying on. Basically, what I'm after are required updates that haven't been downloaded yet and aren't expired (we can't deploy expired updates with ConfigMgr). If you create this view, make sure that you call it v_RequiredUpdates because that's what the script in the next post will query on:

SELECT DISTINCT
TOP (100) PERCENT dbo.v_UpdateInfo.DatePosted, dbo.v_UpdateInfo.BulletinID, dbo.v_UpdateInfo.ArticleID, dbo.v_UpdateInfo.Title,

dbo.CI_ContentFiles.SourceURL, dbo.v_UpdateContents.ContentLocales,

dbo.v_UpdateInfo.IsExpired, dbo.v_UpdateContents.ContentProvisioned

FROM dbo.v_Update_ComplianceStatusAll INNER JOIN

dbo.v_UpdateContents ON dbo.v_Update_ComplianceStatusAll.CI_ID = dbo.v_UpdateContents.CI_ID INNER JOIN

dbo.v_UpdateInfo ON dbo.v_UpdateContents.CI_ID = dbo.v_UpdateInfo.CI_ID INNER JOIN

dbo.CI_ContentFiles ON dbo.v_UpdateContents.Content_ID = dbo.CI_ContentFiles.Content_ID

WHERE (dbo.v_Update_ComplianceStatusAll.Status = 2) AND (dbo.v_UpdateContents.ContentLocales = 'English' OR

dbo.v_UpdateContents.ContentLocales = ' ') AND (dbo.v_UpdateInfo.IsExpired = 'False')

AND (dbo.v_UpdateContents.ContentProvisioned = 0)

ORDER BY dbo.v_UpdateInfo.ArticleID DESC

Here's what the query does (WHERE statements):

Finds all the updates that are displayed as required (dbo.v_Update_ComplianceStatusAll.Status=2)

(and then)
Finds all updates that are either English, or have no language-specific content locale:
- (dbo.v_UpdateContents.ContentLocales = 'English' OR dbo.v_UpdateContents.ContentLocales = ' ')
- You'll need to manually add in any additional languages that you want to download updates for here.
(and then)
Finds all updates that are not expired, because you can't download/deploy expired updates (dbo.v_UpdateInfo.IsExpired = 'False')

(and then)
Finds all of those updates that have not been downloaded yet ((dbo.v_UpdateContents.ContentProvisioned = 0)

(and then)

Orders the resulting update information by article ID (ORDER BY dbo.v_UpdateInfo.ArticleID DESC).

Here are some .sql files that you can use to make all of this easier. I've had to rename their file extensions from .sql to .txt to upload them, but you'll need to right-click and download them anyway because the database to use needs to be changed to your site database name. After modifying the database to use in the files, change the file extension back to .sql before running them:

If you don't really want to go into SQL to create the view, here is a little .sql that will create it the easy way (make sure you change the USE line at the top to use your site database!): Create_v_RequiredUpdates.sql. This one is pretty long so I'm not going to post the contents of it here; you can see what is in there using Notepad.exe though.
If you just want to run the query real fast to see what it's supposed to get, run this: View_v_RequiredUpdates.sql. Below are the contents of that .sql:

/*** Use this .sql to view the query results AFTER you create the v_RequiredUpdates view ***/
/*** Change the USE and FROM lines to use your site database! ***/

USE SMS_XYZ

SELECT [DatePosted]

,[BulletinID]

,[ArticleID]

,[Title]

,[SourceURL]

,[ContentLocales]

FROM [SMS_XYZ].[dbo].[v_RequiredUpdates]

Now that you've got the view returning a list of required updates, the next post will show you how to use that view to actually download them.

~Jeff

Synchronizing Non-Internet Connected Software Update Points

jgilbert — Sun, 19 Oct 2008 03:09:00 GMT

Because the highest level active software update point for a Configuration Manager site hierarchy must synchronize with Microsoft Update, it can be a little difficult to get this working in non-Internet connected sites. This post explains how to get the latest software updates scan metadata imported into the site database to enable software updates functionality for non-Internet connected Configuration Manager sites and site hierarchies.

This process is already documented in the Configuration Manager documentation library, but I figured that I'd blog the steps that I took as another resource for you. You should probably check out the 'official' version first: How to Synchronize Updates Using Export and Import at: http://technet.microsoft.com/en-us/library/bb680473.aspx .

Note: I'm using WSUS 3.0 SP1 because SP1 is required for Configuration Manager 2007 SP1 sites.

To get started, you'll need to have the x86 version of WSUS 3.0 SP1 (WSUSSetup_30SP1_x86.exe) installed on a computer that has Internet access. This is because the tool used to export and import the metadata only works on the x86 version. Clients don't need to connect to this computer and it can even be a VM. We just need to get the WSUS catalog synchronized with Microsoft Update so we can transfer the scan metadata back to the SUP in the non-Internet connected site. WSUS installation is fairly straightforward so I won't go into it in much detail here. Just be sure that you install both WSUS and the administration console and configure the WSUS Server to store updates locally (we won't actually download any updates on this server, but the update EULAs need to be stored locally in the WsusContent directory so we can transfer them later).

If you don't already have it/haven't installed it yet, to get WSUS 3.0 SP1, head to the Windows Server Update Services 3.0 SP1 download page at: http://www.microsoft.com/downloads/details.aspx?FamilyId=F87B4C5E-4161-48AF-9FF8-A96993C688DF&displaylang=en.

Tip: You don't need to install WSUS 3.0 before installing SP1. Just run the SP1 install and you'll have everything you need.

For the WSUS installation that will synchronize with Microsoft Update, you'll need to install both WSUS and the administration console. For the WSUS installation that will be co-located with the non-Internet connected software update point (if it's not on the site server computer), you only need to install WSUS. The WSUS administration console bits need to be installed on the non-Internet connected site server so we can configure the WSUS settings, but that's a standard software update point prerequisite so I'm guessing you already knew that. If you didn't, the prerequisites for Configuration Manager software update point installation are located in this topic Prerequisites for Software Updates at: http://technet.microsoft.com/en-us/library/bb680712.aspx .

I'm going to break down the following steps and call the WSUS Server installation connected to the Internet the WSUS export server and the WSUS installation supporting the software update point site system for the non-Internet connected site the WSUS import server.

On the WSUS export server:

Install WSUS 3.0 SP1 (WSUS and administration console), open the administration console, click Options, and start the WSUS Server Configuration Wizard. Most of the pages are fairly straightforward, but here they are as well as some things to keep in mind while configuring the WSUS installation:
1. Decide if you'll participate in the Microsoft Update Improvement Program.
2. Choose and upstream server to synchronize updates from (you'll want to synchronize with Microsoft Updates).
3. Configure a proxy server if necessary.
4. On the Connect to Upstream Server page, click Start Connecting. This downloads the types of updates available, the products that can be updated and available languages. This is going to take a couple of minutes.
5. On the Choose Languages page, select the languages that you want to download updates for and click Next (it probably doesn't matter what is selected here as we won't use WSUS to download the updates anyway).
6. On the Choose Products page, select the products that you want to synchronize updates for with Microsoft Update. These should be the products that you want to be able to patch your clients for in the non-Internet connected site later (ie Exchange Server 2007, Forefront Client Security, Windows Server 2008, etc…).
7. On the Choose Classifications page, select the update classifications that you want to synchronize with Microsoft Update. Once again, these should be the classifications that you want to be able to patch your clients for in the non-Internet connected site later (ie Critical Updates, Security Updates, Updates, etc…).
8. On the Configure Sync Schedule page, select a sync schedule option. You can either synchronize on a schedule or manually.
9. On the Finished page, select the Begin initial synchronization option. Click Next and then Finish to begin synchronization. Some quick notes about this process:
- Grab a Snickers® it's going to be a while before the initial synchronization completes. I found it to be somewhere between around 1.5 to 2 hours.
- The WSUS database file sizes will increase during this process. The initial database files were 20.1MB and 2 MB for the SUSDB.mdf and SUSDB_log.ldf database files respectively. After synchronization, the database file sizes were 710MB and 61.9MB.
Verify the WSUS installation has completed synchronizing successfully by watching the SoftwareDistribution.log log file (%Program Files%\Update Services\LogFiles\) or you can also check the Synchronizations node of the WSUS administration console.
Next, you need to export software update metadata using the wsusutil.exe utility.

Open a command prompt and navigate to the %Program Files%\Update Services\Tools directory.
Run the following command to export the software updates scan metadata:
wsusutil export <drive letter>:\export.cab <drive letter>:\export.xml. You don't need to name them export.<extension>, it's just something that I do. You can name them whatever you want, but ensure that you save the export as a .cab. I also save the log file as an .xml because it makes it easier to read later.
This takes about 15 minutes or so. In my little lab installation, the exported files were around 8MB for the export.cab and around 4MB for the export.xml. You won't see much interesting going on, but your command prompt should now display:
Updates are being exported. Please do not stop this program.
When it is finished, you'll see this message in the command prompt window: All updates are successfully exported.

On the WSUS import server:

After the metadata export has completed, find some way to copy the export files to WSUS installation that is going to host the software update point for the non-Internet connected site. By this point I'm assuming you already have WSUS 3.0 SP1 and a software update point site system configured for the site. If so, skip to 3, if not go to 2 J
If you're installing WSUS on a soon-to-be software update point site system computer that is not on the site server, you need to install WSUS (no admin console) on the software update point computer and the administration console on the site server computer. However, if you're installing WSUS on the site server computer, you'll need to install the full installation including the Administration Console. If you do need to install the console, do just that—install it, but don't configure it. During installation when the Console Configuration wizard starts—click Cancel. When installing WSUS, take note of these settings:
1. Do not synchronize from Microsoft Update and do not create WSUS reporting events.
2. Do not schedule synchronization (we'll do it manually).
3. Don't worry about the classifications and products settings (you can only configure those if you're sync'ing with Microsoft Update, so we'll handle what metadata we get from the online WSUS Server export files.
4. Select the languages that you want to download (probably doesn't matter because we'll have to manually download these later).
5. Finish the WSUS installation wizard.
6. Install a software update point site system role on the newly installed WSUS Server and review SUP setup logs to ensure it is installed and WSUS is configured successfully: SUPSetup.log and WSUSCtrl.log log files in the ConfigMgr logs directory.
Navigate to the Software Updates node in the Configuration Manager console. Refresh the software updates feature home page and you shouldn't see any software updates information.
Copy the WsusContent directory contents from the export server to the import server's WsusContent directory (C:\WSUS\WsusContent by default).
Import software update metadata using the wsusutil.exe utility so that software updates home page won't be so boring.
1. Open a command prompt and navigate to the %Program Files%\Update Services\Tools directory.
2. Run the following command to import the software updates scan metadata:
  wsusutil import <path>\export.cab <path>\import.xml. Of course, you'll need to know where you copied the .cab file that was exported from the WSUS export server at this point.
3. The import process takes about 15 minutes or so. You still won't see much interesting going on, but during the import process your command prompt should display the following until the import process has completed:
  Updates are being imported. Please do not stop this program.
  When it is finished, you'll see this message in the command prompt window: All updates are successfully imported.
After the import process completes, go back to the Configuration Manager console, expand Software Updates, right-click Update Repository and select Run Synchronization. Some notes about this process:

Grab another Snickers® it's going to be a while again. This is the point where the WSUS software update metadata information is being imported into the site database. To view the progress of the import process, you can watch the wsyncmgr.log log file. This log file tells you how many updates (metadata) were imported and even how long it took—this process took 3 hours and 19 minutes in my lab!
Another disk space consideration: my lab's site database was 223MB before synchronizing metadata. After synchronizing the updates that were exported from the WSUS export server (remember the 8MB export.cab file?), the site database was 891MB!

Refresh Update Repository and Viola! the updates are listed according to the WSUS metadata settings you configured on the WSUS export server for products (ie Exchange Server 2007, Forefront Client Security, Windows Server 2008, etc…) and categories (ie Critical Updates, Security Updates, Updates, etc…) earlier.

Of course, none of those updates display as required by clients until you have clients, with the software updates client agent enabled, complete the software update scan cycle, but that's another post J

~Jeff

Setting Up Multicast in Configuration Manager 2007 R2

jgilbert — Sun, 19 Oct 2008 02:14:00 GMT

Steve Rachui is at it again. This time he's explaining how to setup R2's OSD multicasting feature. It's a great post and contains some very important information that you should be aware of if you're going to implement multicasting--definately a must read.

Steve's post is here: http://blogs.msdn.com/steverac/archive/2008/10/19/setting-up-multicasting-in-sccm.aspx

~Jeff

Client is Installed Flag Explained

jgilbert — Sat, 18 Oct 2008 22:19:00 GMT

Every now and then you might see someone asking about an SMS or ConfigMgr client being physically installed at the client computer, but not appearing as installed in the admin console. This invariably results in someone else pointing them to their site maintenance tasks configuration—which is generally the culprit. I was doing some things in my lab today so I figured that I'd post a basic description of the behavior.

When a client is installed, the site database is updated with the new client's information. This update also 'sets the client is installed flag' as you see mentioned a lot. What that means is that Client=1 is set in the database for the system. Client=1 means the client is installed and Client=0 means that the client is not installed (you can see this property when viewing a discovered resource's properties by double-clicking the record in the admin console).

Even if you manually uninstall the client software from a computer, the installed flag for the computer is not updated in the site database. When that happens, even though the client is not installed, the site database thinks it is (Client bit still says 1). That's why you might sometimes see clients as installed in the console when you know that the client really isn't installed. This can lead you on all sorts of goose chases trying to troubleshoot client health issues that don't really exist. To ensure that doesn't happen, you need to enable the Clear Install Flag site maintenance task. When that task runs, it looks for client systems that have not talked to the site (sent discovery information) during the client rediscovery period that you've set for the task. By default when the task is enabled, the installed flag is cleared for clients (sets Client=0) that haven't sent in discovery data in over 21 days.

Of course, enabling the Clear Install Flag task can also cause problems of its own. Enabling this task sometimes causes clients that you know are installed, to be displayed as not installed in the console. In other words, the client is installed, but the database has Client=0 for the resource. In the console, these computers show up as installed No, but Approved Yes? If the hardware inventory client agent has been enabled for the site, then checking Resource Explorer for one of these computers also shows that they've sent in hardware inventory reports recently (ConfigMgr clients do not generate DDRs when hardware inventory runs). So now you see a computer resource that says it's not installed, is approved, and has sent in recent hardware inventory information. This can lead to understandable confusion and therein lies the motivation for me to write this post—this scenario occurs if the Clear Install Flag maintenance task has been enabled, but the Heartbeat Discovery method has not been enabled for the site or it has been configured incorrectly.

So, pretending that I haven't already given away the cause, some plausible actions you might take to correct this situation would be to push the client bits out to the system using the client push installation wizard and selecting the option to always install or repair to reinstall the client. This will work initially because once installed, the client will send in a DDR to tell the site that it has happily installed and is functioning. Problem solved you think, but then the next time you look at the client resource, it is back to Client=0. Argh. Continuing with that logic, you might go to that computer, open the client applet and initiate the Discovery Data Collection Cycle, the client will then send in a heartbeat DDR and the resource record is back to Client=1. Great, but eventually the client will be back to Client=0 and you're back where you started from. If your client rediscovery period is set to the default (21 days), then this process could become a lengthy one and affect many clients. Add to the mix that when the site-wide Client Push Installation method is enabled, it will attempt to install the client on any systems assigned to the site that have the Client=0 bit set. If you're in this situation, you might see systems with this issue and then, seemingly at random, it's a whole different set of systems later.

To avoid all of this: If you enable the Clear Install Flag site maintenance task, then make sure that you also enable the Heartbeat Discovery method and schedule the Heartbeat Discovery method's recurrence interval to be shorter than the client rediscovery period for the Clear Install Flag task. This will cause clients to send in heartbeat discovery records to update the database and let the Clear Install Flag task know about their continued existence. If the Clear Install Flag task runs and the site hasn't received a heartbeat DDR from an installed client during the client rediscovery period defined for the task, it will set the client installed bit to 0 and we all know what happens after that occurs.

Bonus tip: Sometimes the name of the Clear Install Flag task throws people, but if you watch the smsdbmon.log (the log file that records scheduled maintenance task actions) then you'll see that in the log this task is called: clear undiscovered clients. So it's probably easiest to think of that task as 'the task that clears the installed flag for clients that haven't been rediscovered'. Add 'by heartbeat discovery' to that mental definition and you're in business.

Hope this helps,

~Jeff

Over 10,000 hits to my blog since June!

jgilbert — Sun, 28 Sep 2008 19:15:00 GMT

Since I added ClustrMaps visitor location tracking to my blog in June, I've had over 10,000 visitors!

I thought this was a pretty cool milestone for my blog and it's also interesting to see all the places in the world that visitors are coming from on the global map:

Running total of visits to the above URL since 18 Jun 2008: 10,009
Total since archive, i.e. 18 Jun 2008 - present: 10,009

Unknown Computer Support in ConfigMgr R2 Explained

jgilbert — Sun, 21 Sep 2008 18:44:00 GMT

Steve Rachui just posted some great information about R2's unknown computer support on his blog: http://blogs.msdn.com/steverac/default.aspx

My favorite quote, that I think bears repeating, is:
"Before using this feature stop to consider that this can introduce unwanted image deployments to the environment"

If you're interested in learning more about R2's unknown computer support, check out these posts:

Unknown Computers in SCCM 2007 R2 – overview
http://blogs.msdn.com/steverac/archive/2008/09/21/unknown-computers-in-sccm-2007-r2-overview.aspx

Unknown Computers in SCCM 2007 R2- how it works
http://blogs.msdn.com/steverac/archive/2008/09/21/unknown-computers-in-sccm-2007-r2-how-it-works.aspx

Happy unknown computing…

~Jeff

New App-V Whitepapers Posted Online!

jgilbert — Fri, 19 Sep 2008 16:26:00 GMT

Just like the title says, some new App-V whitepapers have been published on the App-V TechCenter and are now available.

For those interested, the new whitepapers can be found here.
(http://technet.microsoft.com/en-us/appvirtualization/cc843994.aspx):

Title	Description
App-V Security Best Practices	This white paper provides administrators with the starting place for designing security into the App-V infrastructure. The white paper also describes recommended security configurations available in App-V today.
App-V Security Operations Guide	The purpose of this white paper is to provide the App-V administrator with steps to configure security settings. Some of the security settings are well-known configurations within Windows and the appropriate links will be provided.
App-V 4.5 Infrastructure Planning and Design Guide	Use the IPD guide to maximize your organization's time with step by step guidance to ease you through the process of planning your application virtualization infrastructure.
App-V 4.5 Extensibility Today before the SDK	This document presents the administrators with the available tools to automate common tasks in App-V 4.5, including sample scenarios and script examples for each tool.

~Jeff

Anyone need 5GB of freely accessible shared storage?

jgilbert — Fri, 19 Sep 2008 04:16:00 GMT

Have a Live ID? Need to share files and folders between multiple computers or devices?

Check out the Live Mesh Tech Preview at: https://www.mesh.com/Welcome/Welcome.aspx (tour here: http://www.mesh.com/Welcome/Tour.aspx)

Did I mention this also allows you to remote desktop into any computer that is part of your Mesh ring?

OK, I know I said the Arc Mouse was the coolest thing since sliced bread, but today this is my favorite toy

~Jeff

When Smart Quotes Aren’t Smart

jgilbert — Thu, 18 Sep 2008 01:00:00 GMT

If you're configuring native mode for a Configuration Manager site, you might receive a Certificate Request Processor error similar to:

The string contains an Invalid X500 name attribute key, oid, value or delimiter, 0x80092023 (-2146995597).

If you've run into this error and want to know the cause, and how to fix it, see Carol's blog post (from which I have shamelessly borrowed this post's title) at:
http://blogs.technet.com/wemd_ua_-_sms_writing_team/archive/2008/09/18/when-smart-quotes-aren-t-smart-certreq-error-with-the-new-windows-server-2008-ca-step-by-step.aspx

~Jeff

The Microsoft Arc Mouse is now Available for Purchase!

jgilbert — Tue, 09 Sep 2008 20:05:00 GMT

I'm sure I'm not the only one who has been waiting for these to hit the market so for all of you waiting for it: The new Microsoft Arc mouse is now available for purchase! This is the coolest mouse that I've seen in a long time—I must have one!

If you aren't sure what the Arc mouse is, here's the information about it: Microsoft Arc Mouse

And right now, you can buy it at Best Buy or pre order one from Amazon.com (I'm sure other retailers will have it soon).

~Jeff

New Configuration Manager 2007 SP1 Asset Intelligence Update is Available

jgilbert — Fri, 05 Sep 2008 01:49:00 GMT

If you watch the Asset Intelligence forum then you might have noticed an announcement today about a new Asset Intelligence catalog update. If you're using Asset Intelligence and don't follow that forum, you probably should J

Here's a link:
http://forums.microsoft.com/TechNet/ShowForum.aspx?ForumID=1816&SiteID=17

Bad news first: because the MPC codes for some software titles maintained by System Center Online have changed, a few Asset Intelligence license reports are not displaying the correct product codes. This mismatch could cause things like Office 2003 to be displayed as Office 2007 and Windows Server 2003 to be displayed as Windows Server 2008.

The good news is that this update (http://www.microsoft.com/downloads/details.aspx?FamilyId=6D7EDF02-8A2A-4856-82C1-ADDE11529AC7&displaylang=en) corrects that problem for Configuration Manager 2007 SP1 site installations. You should only install this particular update on SP1 level Configuration Manager sites.

An update for this issue for both SMS 2003 SP3 and Configuration Manager 2007 RTM level installations is in the works and will hopefully be released soon.

To see the Asset Intelligence forum post about this, check out: http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=3835031&SiteID=17

Use Live Search to Donate to Charity

jgilbert — Tue, 12 Aug 2008 16:23:00 GMT

So you know about searching using www.live.com...but do you know about www.searchandgive.com?

This site is (which is also powered by Live Search) is a free and easy way to give back to any cause that is important to you. Every time you search, you earn a penny for the non-profit or school of your choice. That may not sound like a lot, but it can add up quickly. So spread the word!

Whether it's your local school or an effort to find a cure, Search and Give will donate a penny each time you use this page to search the Web.

How does it work?

Sign in to select a charity

or school (this is easy)
Start searching from the

Search & Give home page
Live Search will

make the donation

Champion your cause with something you do every day - search the Web.

How to display computer properties on the desktop

jgilbert — Fri, 08 Aug 2008 23:08:00 GMT

Here's a method that I use when setting up lab machines that you might find handy. The problem I always have when switching between VMs is keeping track of which VM I am currently logged on to. The resolution to that problem is displaying computer configuration information on the desktop using the old backinfo.exe power toy. This .exe is available as part of the WSSRA Virtual Environments for Development and Test .zip download here and allows you to display computer configuration information on the local desktop automatically at startup.

Here's how to get/use it:

Download the WSSRA-VE.zip file from http://go.microsoft.com/fwlink/?LinkId=50490
Extract the files from the .zip and run WSSRA-VE_Deployment_Kit.msi to run the WSSRA-Virtual Enterprise Deployment Kit Setup Wizard
After installation, navigate to <drive letter>:\Program Files\WSSRA-VE_Deployment_Kit_2.1.342.0\BLD\Utils
Grab the BackInfo.exe and BackInfo.ini files.
Go to a test computer and tweak the .ini file until you see what you want when bginfo.exe is running.
Copy the .exe and the .ini files to a location on every computer that you want to display settings on the desktop.
Create a shortcut to the .exe in the computer's startup folder or add an entry to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion|Run registry key to autostart bginfo.exe.

Here's a snippet of what a part of one of my MMS 2008 lab machine's desktop looked like with bginfo.exe running:

Hopefully you find that as handy as I do.

~Jeff

Configuration Manager 2007 Sample Configurations and Performance Questions whitepaper published!

jgilbert — Thu, 07 Aug 2008 22:40:00 GMT

Just as the title of this post says, the long awaited Configuration Manager 2007 Sample Configurations and Performance Questions whitepaper has been published to the Web and is available for download at: http://download.microsoft.com/download/4/b/9/4b97e9b7-7056-41ae-8fc8-dd87bc477b54/Sample%20Configurations%20and%20Common%20Performance%20Related%20Questions.pdf

Executive Summary:

This document is designed to provide an overview of sample hardware configurations used in stress and scale testing for different size environments. Additionally, it answers common questions about planning and configuring for optimal performance in Configuration Manager 2007.

Happy reading J

~Jeff

Upgrading the Windows AIK for Configuration Manager 2007 SP1

jgilbert — Tue, 22 Jul 2008 18:16:00 GMT

Before beginning the upgrade process to Configuration Manager 2007 SP1, the Windows AIK 1.0 should be uninstalled from the SMS Provider computer for the site to allow SP1 Setup to install Windows AIK 1.1 to support SP1 OSD WIM images.

If the Windows AIK 1.0 is not uninstalled prior to beginning SP1 Setup, and a PXE service point is installed in the site running the Windows Deployment Services (WDS) Server service, the upgrade might fail and result in an unexpected restart and post-upgrade SMS Executive service crashes.

How to Upgrade the Windows Automated Installation Kit During Site Upgrades to Configuration Manager 2007 SP1

Because Configuration Manager 2007 SP1 sites require Windows AIK version 1.1 to be installed on the SMS Provider computer, the Windows AIK must be upgraded to version 1.1 from version 1.0 during primary site upgrades to Configuration Manager 2007 SP1. If a PXE service point site system has not been installed for the site to be upgraded, Configuration Manager 2007 SP1 Setup will automatically upgrade the Windows AIK 1.0 installation on the SMS Provider computer to version 1.1 during the upgrade process. However, if a PXE service point has been installed for the site to be upgraded, the Windows AIK should be manually uninstalled from the SMS Provider computer for the site before beginning service pack installation. If the Windows Deployment Services (WDS) Server service is running, and has the wimgapi.dll file is in use, an unexpected restart can occur while upgrading the site to Configuration Manager 2007 SP1.

For more information about troubleshooting unexpected system restarts during Configuration Manager 2007 SP1 Setup, see Troubleshooting Configuration Manager 2007 SP1 Setup.

If a PXE service point site system is installed on a computer other than the SMS Provider computer for a site, the wimgapi.dll file used by PXE service point components is not updated to the newest version. Because the updated wimgapi.dll file version is required for Configuration Manager 2007 SP1 PXE service points, operating system deployments using the remote PXE service point will fail until the file is replaced with the new version.

The following procedures can be used to upgrade the Windows AIK during site upgrades to Configuration Manager 2007 SP1 when a PXE service point site system has been installed for the site.

To Upgrade Windows AIK When a PXE Service Point Site System Role is Installed on the SMS Provider Computer for a Site

On the computer hosting both the PXE service point and SMS Provider site system roles for the site to be upgraded, manually uninstall Windows AIK 1.0 from Add or Remove programs and restart the operating system to complete the uninstallation.
Stop the Windows Deployment Services (WDS) Server service. At a command prompt, enter the following command to stop the service: net stop WDSServer and run Configuration Manager 2007 SP1 Setup to upgrade the site and allow Windows AIK 1.1 to be installed.
After the site has been successfully upgraded, restart the Windows Deployment Services (WDS) Server service. At a command prompt, enter the following command to start the service: net start WDSServer.

To Upgrade Windows AIK Files on Remote PXE Service Point Site Systems After Configuration Manager 2007 Service Pack 1 Installation

On the computer hosting the PXE service point site system role, stop the Windows Deployment Services (WDS) Server service. At a command prompt, enter the following command to stop the service: net stop WDSServer.
On the PXE service point computer, navigate to the .\sms\wim directory and run the wimgapi.msi file to install the new version of wimgapi.dll.

Note

A new version of this file is distributed to the site system as part of the Configuration Manager 2007 SP1 upgrade process.

After the successfully upgrading wimgapi.dll to the correct version, restart the Windows Deployment Services (WDS) Server service. At a command prompt, enter the following command to start the service: net start WDSServer.

Already tried to upgrade to Configuration Manager 2007 SP1 without following the above procedures? You might have encountered some unexpected restarts and had some SMS Exec service crashes. Here's how to fix them:

Configuration Manager 2007 SP1 Setup May Cause Unexpected Restarts

If a PXE service point has been installed for the site to be upgraded, the Windows AIK should be manually uninstalled from the SMS Provider computer for the site before beginning service pack installation. If the site server being upgraded has the Windows Deployment Services (WDS) Server service running, and the wimgapi.dll file is in use, an unexpected restart can occur because Windows AIK 1.1 installation requires a system restart to replace this file. Additionally, after the computer restarts, the SMS Executive Configuration Manager Service might fail repeatedly.

Solution

The following procedure can be used to prevent further unexpected restarts during the SP1 upgrade and troubleshoot SMS Executive service failures.

To prevent further unexpected restarts during the SP1 upgrade and troubleshoot SMS Executive service failures

Manually uninstall the failed Windows AIK 1.1 installation from Add or Remove programs and restart the computer.
Stop the Windows Deployment Services (WDS) Server service. At a command prompt, enter the following command to stop the service: net stop WDSServer.
Determine if the SMS Executive service is failing by reviewing the contents of the .\<Configuration Manager Installation Directory>\Logs directory for the presence of a CrashDumps folder. If this folder exists, check for sub-folders created after the unexpected restart.
If subfolders were created in the CrashDumps directory after the unexpected system restart, navigate to the .\ <Configuration Manager Installation Folder>\inboxes\hman.box directory and delete any files present with a .ct2 file extension.
Run Configuration Manager 2007 SP1 Setup to upgrade the site and allow Windows AIK 1.1 to be installed.
After the site has been successfully upgraded, restart the Windows Deployment Services (WDS) Server service on the SMS Provider computer. At a command prompt, enter the following command to start the service: net start WDSServer.

Subselect queries the easy way

jgilbert — Tue, 22 Jul 2008 07:17:00 GMT

Questions about how to use subselect queries seem to come up a lot, and I can never find a good example to use when I go looking for a subselect query. I found this example from Curtis Sawin (a senior Microsoft consultant) today for creating a collection of computers that did not have Project 2003 installed and I figured that I would post it to my blog so that the next time I needed an example of this I wouldn't have to go looking through my bag of tricks (aka collection of snippets spread around about four different computers!).

So, the next time I need a good example of a subselect query I'll just come check this post out...you're welcome to do the same.

From Curtis:

"The reason you need to use a subselected values query is that computers have several entries in ARP, thus all computers have at least one entry in ARP that doesn't equal "Project 2003." Thus, you need to look for resources that have Project, and then look for computers that don't fall in to that query."

And:

"Checking for computers that are not in the results of another query will also return discovered computers that are not ConfigMgr clients (and thus have no ARP data). The way to work around this is to include the query "client = 1" to ensure you're only getting ConfigMgr clients."

And the resulting subselect query:

select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System where SMS_R_System.ResourceId not in (select SMS_R_System.ResourceId from SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS on SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceID = SMS_R_System.ResourceId where SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName = "<Software Title>") and SMS_R_System.Client = 1

NOTE: I've modified the query a little to make it a generic software title subselect query so you'll need to change the <Software Title> text between the quotation marks to the display name for the software title you're after—don't forget to get rid of the <>'s.

Here are some screen shots of what you should be seeing in your collection properties now:

Subselect query criteria screen shot

Subselect query WQL statement screen shot (yours shouldn't say <Software Title>)

Here's the handy C&P method of creating a collection based on a subselect query:

Right-click Collections
Click New Collection from the context menu
Give the collection a name and a comment if you want to
On the Membership Rules page of the New Collection Wizard, click the database query button
Give the query a name
Click Edit Query Statement...
Click Show Query Language
C&P the subselect query above to overwrite the default select * from SMS_R_System (make sure you change <Software Title> to a real software title!)
Click OK
Click OK
Finish the wizard

Viola! A new collection based on a subselect query! Update the collection membership and hopefully you see what you're looking for!

Afraid you'll lose this little subselect query? Here's an easy way to keep it handy when you need it. Navigate down the console to Queries under Computer management and create a new query using the WQL I posted earlier (leave <Software Title> in it) and name it something inventive like "Subselect Query By Software Title".

Now, the next time you want to create a collection of computers without a software title installed, you can click Import Query Statement (as opposed to Edit Query Statement… above in step 6) and select your pre-made subselect query. Modify the collection's query statement as necessary and you're off with just a few clicks. Your query down at the bottom isn't changed when you modify the query statement for the collection and so you can re-use the snippet as often as your heart desires.

Importing Non-Microsoft License Data into the Configuration Manager 2007 SP1 Site Database

jgilbert — Thu, 17 Jul 2008 17:36:00 GMT

I'm updating the official documentation for this right now, but since there seems to be a lot of confusion about this process, I figured I'd post here as well. This way the information will be 'out there' before the next documentation update to the Web (planned for when Configuration Manager 2007 R2 RTM's).

First off, you can only do this with the Asset Intelligence feature included in Configuration Manager 2007 SP1 so if you are not running that stop reading and go upgrade your site!

Anyway, the quick intro to this is that by using the Asset Intelligence License Import Wizard included in ConfigMgr SP1, you can import both Microsoft and non-Microsoft software license information into the site database to help in inventorying the licensed software in use in your enterprise. You can then use Asset Intelligence reports to compare what you have versus what you paid for. Pretty handy.

NOTE: Microsoft MVLS license import files need to be in .xml format and non-Microsoft license import files need to be in .csv format to import the information into the site database.

Regardless of whether or not you're importing Microsoft MVLS license information or non-Microsoft software license information, the license information stored in the database is completely overwritten with the new values in the import file so make sure that the license file you import is all-inclusive or else you might lose some licenses already stored in the database.

This post isn't about importing MVLS license statements into the site database, but rather how to create your own "3^rd party", non-Microsoft license import file. That's not to say you can't have Microsoft software license information in the file, just that it's not a direct conversion from an MVLS license file.

So that's the preamble and here is a snippet from the topic with the procedure for importing non-Microsoft licenses using Microsoft Office Excel and the Asset Intelligence License Import Wizard:

The following procedure describes the process that can be used to create a non-Microsoft software license import file using Microsoft Office Excel.

To Create a non-Microsoft License Import File Using Microsoft Office Excel

Open Microsoft Office Excel and create a new spreadsheet.

On the first row of the new spreadsheet, enter all software license data field names.

Note

While all header fields must be defined on the first row, only the Name, Publisher, Version, and Effective Quantity fields are required to contain data on subsequent rows. All fields requiring a date formatted entry should be entered in the following format: Month/Day/Year as in this example: 8/4/2008.

On the second and subsequent rows of the new spreadsheet, enter software license information as required. Ensure that at least all of the required software license data fields are entered on subsequent rows for each software license to be imported. The software title name entered in the spreadsheet must be the same as the software title that is displayed in Resource Explorer for a client computer after hardware inventory has run.
From the Microsoft Office Excel file menu, save the file in .csv format.
Copy the .csv file to the file share that will be used to import software license information into the Asset Intelligence catalog using the Asset Intelligence License Import Wizard.
From within the Configuration Manager console, use the Asset Intelligence License Import Wizard to import the newly created .csv license information file.
Run the Asset Intelligence License 15A – Third Party Software Reconciliation Report to verify that the licensing information has been successfully imported into the Asset Intelligence catalog.

When everything is ready to go (with only the required fields filled in), your .csv should look something like this:

Name	Publisher	Version	Language	EffectiveQuantity	PONumber	ResellerName	DateOfPurchase	SupportPurchased	SupportExpirationDate	Comments
Software Title 1	Software Publisher 1	1		1
Software Title 2	Software Publisher 2	1		2
Software Title 3	Software Publisher 3	1.1		3
Software Title 4	Software Publisher 4	1.2		4
Software Title 5	Software Publisher 5	1.3		5
Software Title 6	Software Publisher 6	1.4		6
Software Title 7	Software Publisher 7	1.5		7
Software Title 8	Software Publisher 8	1.6		8
Software Title 9	Software Publisher 9	1.7		9
Software Title 10	Software Publisher 10	1.8		10

When viewed with notepad it looks like this:

Name,Publisher,Version,Language,EffectiveQuantity,PONumber,ResellerName,DateOfPurchase,SupportPurchased,SupportExpirationDate,Comments

Software Title 1,Software Publisher 1,1,,1,,,,,,

Software Title 2,Software Publisher 2,1,,2,,,,,,

Software Title 3,Software Publisher 3,1.1,,3,,,,,,

Software Title 4,Software Publisher 4,1.2,,4,,,,,,

Software Title 5,Software Publisher 5,1.3,,5,,,,,,

Software Title 6,Software Publisher 6,1.4,,6,,,,,,

Software Title 7,Software Publisher 7,1.5,,7,,,,,,

Software Title 8,Software Publisher 8,1.6,,8,,,,,,

Software Title 9,Software Publisher 9,1.7,,9,,,,,,

Software Title 10,Software Publisher 10,1.8,,10,,,,,,

I hope this helps!

How To Configure ISA SSL Bridging for Configuration Manager Internet-Based Client Management

jgilbert — Thu, 03 Jul 2008 17:54:00 GMT

In case you missed it (you do read our writers' blog don't you?! http://blogs.technet.com/wemd_ua_-_sms_writing_team/default.aspx), Carol has just posted about the new documentation she was heavily involved in creating about ISA SSL bridging now being available on TechNet.

From Carol:

Just Published on TechNet: How to Configure ISA SSL Bridging for System Center Configuration Manager Internet-Based Client Management

I'm delighted to let you know that the ISA Server documentation team has just published How to Configure ISA SSL Bridging for System Center Configuration Manager Internet-Based Client Management.

This has been a joint collaboration between the ISA Server product group and the Configuration Manager product group – and special thanks to Jim Harrison (ISA Server PM), Nathan Bigman (ISA Server Content Publishing Manager), and Adam Meltzer (Configuration Manager test engineer).

I would also like to add my thanks to our ISA friends and reviewers:

Jason Jones (ISA expert from Silverlands Limited, with his own blog at http://blog.msfirewall.org.uk/)
Tom Shinder (ISA MVP, consultant, trainer, author of many best-selling books and articles – check out http://blogs.isaserver.org/shinder/ )

Wondering if SMS 2003 SP3 or Configuration Manager 2007 Supports Vista SP1 or Windows Server 2008 Clients?

jgilbert — Fri, 27 Jun 2008 22:00:00 GMT

Wonder no more! The updated SMS 2003 SP3 Supported Configurations document has been updated to reflect support for both Windows Vista SP1 and Windows Server 2008 clients. The Configuration Manager 2007 RTM supported configurations has also been updated to reflect support for these operating systems.

The latest SMS 2003 SP3 Supported Configurations document can be found online here: http://technet.microsoft.com/en-us/library/cc179956.aspx.

The latest Configuration Manager 2007 RTM Supported Configurations document can be found online here: http://technet.microsoft.com/en-us/library/cc161860.aspx.

Here's some more quick information about this update:

It is not supported to install the SMS 2003 SP3 or Configuration Manager 2007 RTM admin console on Windows Server 2008.
It is supported to install the SMS 2003 SP3 or Configuration Manager 2007 RTM admin console on Windows Vista SP1.
It is not supported to install any site system roles on either operating system, with the exceptions of:
- Windows Vista and Windows Server 2008 as branch distribution points in Configuration Manager RTM
- Windows Server 2008 as a System Health Validator (Network Policy Server for NAP) in Configuration Manager RTM
Neither release supports the Windows Server 2008 Core Installation option at this time.

OK, so you've got SMS 2003 SP3 installed with Vista SP1 clients, but you can't narrow down package properties to only run on Vista SP1?

You need this hotfix: SMS 2003 with Service Pack 3 cannot deploy a package to client computers that are running Windows Vista with Service Pack 1.

System Center Online authentication certificate for AI sync points

jgilbert — Mon, 02 Jun 2008 23:07:00 GMT

The Asset Intelligence synchronization point (ConfigMgr SP1 site system role) needs to be provisioned with an authentication certficate issued by System Center Online to provide on-demand catalog updates. To get the certificate, you must have an active SA contract with Microsoft for Configuration Manager.

Read more about it here:
How do I get the System Center Online Cert for AI 1.5?

What's coming in System Center Configuration Manager with Bryan Keller

jgilbert — Wed, 07 May 2008 17:01:00 GMT

Curious about what is coming with Configuration Manager 2007 SP1 or R2? Check out Adam Carter's video interview with Bryan Keller at MMS 2008 on TechNet edge where he demo'd some cool stuff including Asset Intelligence in Configuration Manager 2007 SP1 (AI 1.5) and virtual application management capabilities coming with Configuration Manager 2007 R2:

http://edge.technet.com/Media/Whats-coming-in-System-Center-Configuration-Manager-with-Bryan-Keller/

~Jeff

Inserting auto-text in a Word document

jgilbert — Fri, 18 Apr 2008 19:24:00 GMT

I think this is pretty cool and fun to play with (I like to insert things like this in documentation tech reviews to see if anyone notices…).

Anyway, to automatically insert random text in a doc, you can use the =lorem() or =rand() commands. The =lorem() command inserts the "lorem ipsum" Latin gibberish and the =rand() command inserts random strings from the help file J Using either command you can also specify the number of paragraphs or sentences in the ()'s. So to insert 3 paragraphs of Latin gibberish with each paragraph being 5 sentences long, you would use =lorem(3,5) and then just hit enter.

=lorem() <enter> gives you this:

Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Maecenas porttitor congue massa. Fusce posuere, magna sed pulvinar ultricies, purus lectus malesuada libero, sit amet commodo magna eros quis urna.

Nunc viverra imperdiet enim. Fusce est. Vivamus a tellus.

Pellentesque habitant morbi tristique senectus et netus et malesuada fames ac turpis egestas. Proin pharetra nonummy pede. Mauris et orci.

NOTE: =lorem() only works in Word 2007

If you're wondering what all that lorem ipsum stuff really means, check this out: http://support.microsoft.com/kb/114222

Moving along, =rand() <enter> gives you this:

On the Insert tab, the galleries include items that are designed to coordinate with the overall look of your document. You can use these galleries to insert tables, headers, footers, lists, cover pages, and other document building blocks. When you create pictures, charts, or diagrams, they also coordinate with your current document look.

You can easily change the formatting of selected text in the document text by choosing a look for the selected text from the Quick Styles gallery on the Home tab. You can also format text directly by using the other controls on the Home tab. Most controls offer a choice of using the look from the current theme or using a format that you specify directly.

To change the overall look of your document, choose new Theme elements on the Page Layout tab. To change the looks available in the Quick Style gallery, use the Change Current Quick Style Set command. Both the Themes gallery and the Quick Styles gallery provide reset commands so that you can always restore the look of your document to the original contained in your current template.

~Jeff