TassieTech

ConfigMgr 2012 R2 Forcing Content Validation

2014-01-24T15:44:00.000+11:00

Have you ever needed to trigger a full content validation on one or all of your distribution points?
There are a couple of options out of the box.

Open the Administration > Distribution Points > <DPName> object, and hit up the Content Validation Tab.
Here you can set a validation schedule.
Open Software Library > Application Management > Application > <AppObject> and go to the Content Locations Tab. Here you can select an individual DP, and ask it to validate for this package.
This is not a cool way to do it!

So there must be a better way! The good news - There Is!
There are a few scripts about now that will help you to get the content validation up and away. Here are some links to some I found useful.

http://myitforum.com/myitforumwp/2013/04/19/how-to-initiate-the-validate-action-on-all-dps-for-a-package-in-configmgr-2012/

http://cm12sdk.net/?p=572

These were ok, but they didn't show me how to kick off a full validation on a Distribution Point, or on a bunch of them.
I did some digging and wrote the following few recipe with PowerShell:

Ingredients:
- Powershell
- ConfigurationManager Powershell Module

Steps (for One Distribution Point):

Import-Module ($Env:SMS_ADMIN_UI_PATH.Substring(0,$Env:SMS_ADMIN_UI_PATH.Length-5) + '\ConfigurationManager.psd1')
$PSD = Get-PSDrive -PSProvider CMSite
CD "$($PSD)"
$ServerFQDN = "SOMESERVER.mydomain.com"
$SiteCode = "XYZ"
$TimeNow = Date
$TimeInTen = $TimeNow.AddMinutes(10)
$ValidationSchedule = New-CMSchedule -Start $TimeInTen -DayOfWeek $($TimeNow.DayOfWeek)
Set-CMDistributionPoint -SiteCode $SiteCode -SiteSystemServerName $ServerFQDN -ValidateContentSchedule $ValidationSchedule
Write-Host "Validation Scheduled for $($TimeInTen) on $($ServerFQDN)"

Steps (for All Distribution Points):

Import-Module ($Env:SMS_ADMIN_UI_PATH.Substring(0,$Env:SMS_ADMIN_UI_PATH.Length-5) + '\ConfigurationManager.psd1')$PSD = Get-PSDrive -PSProvider CMSiteCD "$($PSD):"$SiteCode = "XYZ"
$AllDPs = Get-WmiObject -Namespace root\sms\site_$($SiteCode) -Class SMS_DPStatusInfo -Property NALPath
$ExcludeFromProcessing = @("NOTTHISSERVER.mydomain.com")
foreach ($DP in $AllDPs){ $ServerFQDN = $DP.NALPath.Substring(12).Split('\')[0] if ($ServerFQDN -notin $ExcludeFromProcessing) { $TimeNow = Date $TimeInTen = $TimeNow.AddMinutes(10) $ValidationSchedule = New-CMSchedule -Start $TimeInTen -DayOfWeek $($TimeNow.DayOfWeek) Set-CMDistributionPoint -SiteCode $SiteCode -SiteSystemServerName $ServerFQDN -ValidateContentSchedule $ValidationSchedule Write-Host "Validation Scheduled for $($TimeInTen) on $($ServerFQDN)" }}

Of course, this means that you will have a scheduled validation at 10minutes from 'now' every week. This may not be a bad thing - but it is something to be mindful of.

Lastly, note that content validation will NOT validate content in the package share directory, only the content library.

Let me know if this is useful to you and I will add some more bits and pieces.

ConfigMgr 2012 PXEPassword Reset

2013-11-28T15:34:00.002+11:00

Hi, If you have gone through the upgrade to SCCM 2012 R2, then you may find yourself with a distmgr.log entry like this:
Failed to get the encrypted PXE password SMS_DISTRIBUTION_MANAGER 28/11/2013 12:08:25 PM 1912 (0x0778)

For this, you are going to need to re-enter the password on each Distribution Point.

Now, I'm sure you know how long this takes to do through the console.

Here's a script that can help!

(this is a modified version of http://myitforum.com/myitforumwp/2013/11/21/change-pxe-password-on-all-dps/ as this one assumes that all the DP's are PXE Enabled - which for us, is not the case - Thanks for the heads up Raphael!)

Import-Module ($Env:SMS_ADMIN_UI_PATH.Substring(0,$Env:SMS_ADMIN_UI_PATH.Length-5) + '\ConfigurationManager.psd1')
$PSD = Get-PSDrive -PSProvider CMSite
CD "$($PSD):"
$strSiteData = CMSite
$sdkserver = $strSiteData.ServerName
$SiteCode = $strSiteData.SiteCode
$NewPXEPassword = "superpassword!"
$property = "PXEPassword"
## Make a password object ##
$passwordclass = [wmiclass]“”
$passwordclass.psbase.Path = “\\” + $sdkserver + “\ROOT\SMS\site_” + $SiteCode + “:SMS_Site”
$inParams = $passwordclass.GetMethodParameters(“EncryptDataEx”)
$inParams["Data"] = $NewPXEPassword
$inParams["SiteCode"] = $SiteCode
$outParams = $passwordclass.InvokeMethod(“EncryptDataEx”, $inParams, $null)
$PXEpassword = $outParams.EncryptedData.ToString()
#Write-Output “PXE Password is set to the following encrypted value: ” $PXEpassword
## Gather DP's to Action
$query = "SELECT * FROM SMS_DistributionPointInfo WHERE IsPXE = 1"
$AllPXEDPs = Get-WmiObject -ComputerName $sdkserver -Namespace "ROOT\SMS\Site_$($SiteCode)" -Query $query | select Name
foreach ($dpObj in $AllPXEDPs)
{
Write-Host "Updating PXEPassword on $($dpObj.Name)"
$query = "SELECT * from SMS_SCI_SysResUse WHERE NetworkOSPath LIKE '%$($dpObj.Name)%' AND RoleName = 'SMS Distribution Point'"
$dp = Get-WmiObject -ComputerName $sdkserver -Namespace "root\sms\site_$SiteCode" -Query $query
##Call Get on the object to return ALL the properties.
##KNOWN ISSUE: if you have too much info in the PFXData property of the Props array, it wont return anything! Props=Null
$dp.Get()

#Copy Props to a new varible so we can mod it
$props = $dp.Props
$prop = $props | where {$_.PropertyName -eq $property}
$prop.Value = 0
$prop.Value1 = $PXEpassword
$prop.Value2 = $null
#Write Props back/over existing props
$dp.Props = $props
#Out to Null so we dont get screen garbage
$dp.Put() | Out-Null
Write-Host "Finished Updating PXEPassword on $($dpObj.Name)"
}

Once you run this, the distmgr log will begin processing the changes.

NOTE: if it is already processing stuff, it's going to finish that first.....

ConfigureDP SMS_DISTRIBUTION_MANAGER 28/11/2013 3:28:03 PM 1508 (0x05E4)

IISPortsList in the SCF is "80". SMS_DISTRIBUTION_MANAGER 28/11/2013 3:28:03 PM 1508 (0x05E4)

IISSSLPortsList in the SCF is "443". SMS_DISTRIBUTION_MANAGER 28/11/2013 3:28:03 PM 1508 (0x05E4)

IISWebSiteName in the SCF is "". SMS_DISTRIBUTION_MANAGER 28/11/2013 3:28:03 PM 1508 (0x05E4)

IISSSLState in the SCF is 224. SMS_DISTRIBUTION_MANAGER 28/11/2013 3:28:03 PM 1508 (0x05E4)

DP registry settings have been successfully updated on SERVERNAME.Domain SMS_DISTRIBUTION_MANAGER 28/11/2013 3:28:03 PM 1508 (0x05E4)

STATMSG: ID=9500 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER" SYS=SERVERNAME.Domain SITE=TS1 PID=2548 TID=1508 GMTDATE=Thu Nov 28 04:28:03.885 2013 ISTR0="["Display=\\SERVERNAME.Domain\"]MSWNET:["SMS_SITE=TS1"]\\SERVERNAME.Domain\" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=1 AID0=404 AVAL0="["Display=\\SERVERNAME.Domain\"]MSWNET:["SMS_SITE=TS1"]\\SERVERNAME.Domain\" SMS_DISTRIBUTION_MANAGER 28/11/2013 3:28:03 PM 1508 (0x05E4)

STATMSG: ID=9503 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER" SYS=SERVERNAME.Domain SITE=TS1 PID=2548 TID=1508 GMTDATE=Thu Nov 28 04:28:03.886 2013 ISTR0="["Display=\\SERVERNAME.Domain\"]MSWNET:["SMS_SITE=TS1"]\\SERVERNAME.Domain\" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=1 AID0=404 AVAL0="["Display=\\SERVERNAME.Domain\"]MSWNET:["SMS_SITE=TS1"]\\SERVERNAME.Domain\" SMS_DISTRIBUTION_MANAGER 28/11/2013 3:28:03 PM 1508 (0x05E4)

ConfigurePXE SMS_DISTRIBUTION_MANAGER 28/11/2013 3:28:03 PM 1508 (0x05E4)

No need to initialize monitoring task on SERVERNAME.Domain SMS_DISTRIBUTION_MANAGER 28/11/2013 3:28:04 PM 1508 (0x05E4)

DP settings have been updated to SERVERNAME.Domain. SMS_DISTRIBUTION_MANAGER 28/11/2013 3:28:04 PM 1508 (0x05E4)

Initialize usage gathering task on SERVERNAME.Domain SMS_DISTRIBUTION_MANAGER 28/11/2013 3:28:04 PM 1508 (0x05E4)

DP settings have been updated to SERVERNAME.Domain. SMS_DISTRIBUTION_MANAGER 28/11/2013 3:28:05 PM 1508 (0x05E4)

OS information for the server - 6.2.9200 SMS_DISTRIBUTION_MANAGER 28/11/2013 3:28:05 PM 1508 (0x05E4)

ConfigMgr 2012 R2 Upgrade Reboot

2013-11-28T14:59:00.000+11:00

Just thought I would write this one up quickly as it impacted us quite a bit Today!

We started the upgrade process to SCCM 2012 R2 from 2012 SP1 CU3 the other day.
In along with this we also decided it would be a good time to upgrade to Server 2012 R2 from Server 2012.

Here are two little gotchas to lookout for if you are doing the same!

Site Reset
Lookout for the site reset, if you have a large number of DP's for example, they are going to take a while to process.
The following things will happen, (listed in no particular order)
1) New Boot WIM's will be deployed to all your DP's if you had any deployed already. (x64 and x86).
2) A new ConfigMgr Client package will be re-distributed.
3) A new ConfigMgr Upgrade package will be re-distributed.
4) All your DP's will be re-set and checked.
5) If you had configured PXE Passwords, the new environment probably wont recognise them, and you will need to re-enter them. (I'll post a script that can be used to fix this - here)
Reported in the distmgr.log: Failed to get the encrypted PXE password

The processing of these actions is all logged in the distmgr and PkgXferMgr logs and it's going to take a while depending on how many DP's you have.
For example, we have ~200DP's configured as PullDP's, it took about 3.5 hours to go through this list.

DistMgr can only upgrade 5 DP's at a time due to a limit. Distmgr can also only process 7 packages at a time, with 10 threads per package.
Due to trying to push out packages (notify PkgXferMgr), and upgrade DP's it seems to get snowed under.
It appears that initially it marks all the DP's as Not installed.
Reset 'IsPullDPInstalled' to FALSE so that PullDP SERVERNAME will be updated immediately SMS_DISTRIBUTION_MANAGER 28/11/2013 12:10:45 PM 2704 (0x0A90)
PullDP ["Display=\\SERVERNAME\"]MSWNET:["SMS_SITE=DOE"]\\SERVERNAME\ is marked Uninstalled SMS_DISTRIBUTION_MANAGER 28/11/2013 12:10:46 PM 2704 (0x0A90)

It goes through and does this for ALL installed DP's first, and THEN starts re-installing them.
The distribution point ["Display=\\SERVERNAME\"]MSWNET:["SMS_SITE=DOE"]\\SERVERNAME\ is not installed or upgraded yet.

All the while, also trying to update packages and everything else.
You then think, well, I better fix the passwords, but that also gets added to the end of the distribution queue, and so has no effect until all the other processing happens first!

The Reboot!
This one is the nasty one that caught us off guard. . .
When the DP's were being 'upgraded' they ran this command:
Run command 'M:\SMS_DP$\sms\bin\vcredist_x64.exe /q /log "M:\SMS_DP$\sms\bin\vcredist.log"' to install VC redist
(This is due to the Visual C++ 2010 Redistributable being a new pre-req)
If the file 'C:\Windows\system32\msvcr100.dll' is in use, then the server will be rebooted:

Windows Installer requires a system restart. Product Name: Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219. Product Version: 10.0.40219. Product Language: 0. Manufacturer: Microsoft Corporation. Type of System Restart: 2. Reason for Restart: 1.

Product: Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219. Restart required. The installation or update for the product required a restart for all changes to take effect. The restart was deferred to a later time.

Now, it says the restart was deferred, it lies, in our cases it DID reboot. . . immediately!

I don't have a workaround for this, maybe upgrade your VC++ early, and get around it that way.
The file was in use by a number of processes, Symantec Endpoint, BackupAssist, and the SCOM Monitoring Agent.

We stopped smsexec, and waited until after hours to restart the upgrades.

Hope this helps if you are about to do the same!

ConfigMgr 2012 SP1 - Add-CMStateMigrationPoint Issue

2013-09-20T20:56:00.000+10:00

Today while deploying five site systems I noticed a small issue with our deployments that we hadn't really looked into before.

The State Migration Point installation was going through ok, but there were errors in the logs about permissions.

Two things stood out.
Firstly, the smpisapi.log file was complaining about not being able to access a share on the primary server. I was curious as to why SMP wanted to do this. It brought back memories of the Add-CMDistributionPoint CmdLet that sets an incorrect Server Remote Name property in WMI/SQL.

Secondly, Permissions in generally looked screwy on the USMT folder meaning that we were getting error 500 from IIS in the smpisapi.log. Whenever we changed the permissions on the folder to allow Local Service Full Control, it would update the permissions back to just Administrators and System. And return to the 500 error.

To remedy problem 2, I jumped into IIS and had a look at the Application Pools.
Here there is a pool for the SMS State Migration Point, and the service account is set to Local Service. I changed it to Local System, stopped it, and started it. Then restarted the smsexec service. This seems to fix problem 2!

(On Some occasions, we have also had to modify the share permissions of the sub folder of USMT to add the Computer Account with full control).

To remedy problem 2, I had a hunch that the issue was being caused by the Add-CMStateMigrationPoint CmdLet that we were using. So I jumped onto the SQL Database and ran the following Query to find out.

Select * from vSMS_SC_SysResUse Where RoleName like '%Migration%'

This returns a list of all the State Migration Points in your environment.
Next up, I ran this query:

select props.Name, srs.ServerName,props.Value1 from vSMS_SC_SysResUse_Properties as props
Join vSMS_SC_SysResUse as srs on props.ID = srs.ID
where props.ID in (select ID from vSMS_SC_SysResUse where RoleName like '%Migration%')
AND
props.Name = 'Server Remote Name'

With this, I could immediately see that some of my entries were not matching (they should match!).

So the SAME issue exists as in Add-CMDistributionPoint. Therefore the same fix should work.
Here is the PowerShell script that I came up with to remediate it.

Import-Module ($Env:SMS_ADMIN_UI_PATH.Substring(0,$Env:SMS_ADMIN_UI_PATH.Length-5) + '\ConfigurationManager.psd1')$PSD = Get-PSDrive -PSProvider CMSiteCD "$($PSD):"$strSiteData = CMSite$strProviderSiteServer = $strSiteData.ServerName$strProvSiteCode = $strSiteData.SiteCodeFunction Set-Property{ PARAM( $MPServer, $SiteCode, $PropertyName, $Value, $Value1, $Value2 ) $embeddedproperty_class = [wmiclass]"" $embeddedproperty_class.psbase.Path = "\\$($MPServer)\ROOT\SMS\Site_$($SiteCode):SMS_EmbeddedProperty" $embeddedproperty = $embeddedproperty_class.createInstance() $embeddedproperty.PropertyName = $PropertyName $embeddedproperty.Value = $Value $embeddedproperty.Value1 = $Value1 $embeddedproperty.Value2 = $Value2 return $embeddedproperty}
$query = "SELECT * FROM SMS_SCI_SysResUse WHERE RoleName like '%Migration%'"$objQueryResult = Get-WmiObject -ComputerName $strProviderSiteServer -Namespace "ROOT\SMS\Site_$strProvSiteCode" -Query $query foreach ($smp in $objQueryResult){ $UpdateSMP = $False $smp.get() foreach ($prop in $smp.props) { if ($prop.PropertyName -eq "Server Remote Name") { if ($smp.NetworkOSPath.Substring(2,$($smp.NetworkOSPath.Length-2)) -ne $($prop.Value1)) { Write-Host "Not Similar $($smp.NetworkOSPath) : $($prop.Value1)" $smp.Props += [System.Management.ManagementBaseObject](Set-Property -MPServer $strProviderSiteServer -sitecode $strProvSiteCode -PropertyName "Server Remote Name" -value 0 -value1 ($smp.NetworkOSPath.Substring(2,$($smp.NetworkOSPath.Length-2))) -value2 '') $UpdateSMP = $True } } } if ($UpdateSMP) { write-host "Update Required for $($smp.NetworkOSPath)" $smp.Put() }}

Now we can happily automate again.

ConfigMgr 2012 SP1 - When Packages Get Stuck

2013-08-07T10:16:00.004+10:00

Over the last few days, I have been working through numerous scenarios and issues, most of which we have resolved without too much trouble.

Problem 1

One scenario that was a little interesting was when we were trying to re-distribute the built in boot images to some distribution points. We had removed the package from the distribution points, as we didn't think we would need them....turns out we did.
When we went to re-add them, the distribution status kept informing us that there were no distribution points targeted. We did this a few times, both the individual DP's as well as DP groups, each time we re-open the content locations tab on the boot package properties, it showed no DP's!

On investigating the logs we found something odd.
The logs were reporting that the content was being REMOVED from the DP, not added to, and then, that it was removing the DP from the date sources.

OK, that's odd, but how do I fix it?

The Fix - Problem 1

This was the first 'stuck' package we had come across in ConfigMgr 2012. It appeared that the package was stuck in a cycle of trying to be removed from the DP's, but was never finishing the task. THe content was still in the SCCMContentLib on both DP's.

After a bit of a search, we turned up a database query to find which servers the package was located on:

select * from PkgServers where PkgId = 'PRI00004' and SiteCode = 'PRI'

This returned 2 entries for the package in question. The interesting bits fields were:

Action = 3
SiteName = NULL
UpdateMask = 8192
LastRefresh = 1970...

We deleted the two entries with this command:

delete from PkgServers where PkgId = 'PRI00004' and SiteCode = 'PRI'

Now, when we went back to the console, we were able to successfully redistribute the package to the DP's.

Problem 2

The next issue that we came across was after testing some DR processes (failing the Primary Server, and Re-Installing it), we found that the Configuration Manager Client Upgrade Package was not being distributed to one of the DP's. It was in a failed state and wouldn't budge.
The trouble with this package is, that it is a hidden package, and you cant refresh it from the console, or delete it, or validate it etc.
Luckily, there is a PowerShell command that can do that for us.
The PackageID for the hidden upgrade package is always the same 'XXX00003' where XXX is your SiteCode.

$AllDPs = Get-WmiObject -Namespace "Root\SMS\Site_PRI" -Query "select * from SMS_DistributionPoint where PackageID = 'PRI00003'"

foreach ($DP in $AllDPs) {

$DP.RefreshNow = $true

$DP.Put()

}

Try as it might though, the primary server couldn't refresh the package. The distmgr.log revealed the following error:

ExecStaticMethod failed (80041001) SMS_DistributionPoint, FinalizeContent

After a bit of searching, it appeared to be related to a permissions issue.
Looking at the DP's SCCMContentLib\DateLib directory, I could see a folder for the package:

PRI00003.6

When trying to open the folder though, I was greeted with an access denied, despite being an admin on the server.

The Fix - Problem 2

Repeated attempts to to take ownership of the folder failed, as I didn't have permissions to do it. I also tried using PowerShell's Get-Acl and Set-Acl, but these also failed with Access Denied.

I realised that the commands needed to be ran as System, or the local computer account.
With a wave of the ol RegEdit, I added in 2 RunOnce entries:

takeown /F D:\SCCContentLib\DataLib\PRI00003.6 /A /R
ICacls D:\SCCMContentLib\DataLib\PRI00003.6 /reset

With a quick reboot, the permissions were restored.
After re-running the powershell commands above, the package was successfully transferred back to the DP!

ConfigMgr 2012 SP1 - Controlling User access with Role Based Administration

2013-06-28T20:19:00.000+10:00

I'd like to control user access in ConfigMgr. What would you like with that?
It seems you can mix and match, and make it up as you go along. I guess it's a bit like going to Subway. They have all the menu items listed, but you don't need to choose them, you can roll your own!

We needed to roll up some security in our environment to 'limit the damage'. We all know how easy it is to deploy a piece of software or configuration to a bunch of devices by accident, and how fast things deploy when you don't want them to! Thankfully, the new Role Based Administration in ConfigMgr 2012 is here to save us!

Enter RBA

Our requirements are fairly simple, but the spread of devices is what adds the complexity. Let me explain.

We have around 230 sites, each with their own fleet of devices. They range from sites with 20 devices, to sites with 1600. Most are in between these extremes. To support these sites, we have around 150 support staff who provide all the front line desktop support services. Next up, we have around 8 support staff that look after the SoE - that is Drivers, Task Sequences, Desired Configuration Management, and other things related to Operating System Deployment. Finally, there are the ConfigMgr admins, who just ensure things tick, and repair components when they fall down.

In our ConfigMgr 2007 environment, all users are added individually, and the permission set is pretty vague. We wanted much more granularity when it came to 2012. Each of our front line support staff look after 5-10 sites, and don't often have to manage devices outside these scopes.

Components of RBA

The components that make up RBA are:

Security Scopes: Used to limit the objects that an administrative access can manage.
Security Roles: Grant actions that can be performed on a securable object.
Administrative Users/Groups: Are Users/Groups from Active Directory, that are assigned Roles, Scopes and Collections to define a set of permissions to objects.
Collections: Are groups of resources such as Users or Devices.

By combining these elements for an Administrative User or Group you can really fine tune your security.

Our Requirements

To kick off, we thought about what are the minimum requirements for each of our support roles.

Front line support:

As a front line support person, you need to be able to see what devices are in which collections, and which deployments are/should be targeting your clients. You should also be able to see which packages and applications have been created and deployed, and which are still in development.

Front line support staff also have some other requirements.

Package/Application Creation and Testing.
Deploy a Tested and Approved Application.

Not all front line support staff will be given permissions to create and/or deploy applications, so this needs to be granular.

SoE Admin:

As a SoE administrator, you need to be able to update drivers and driver packages, work with task sequences, distribute packages and applications, and generally do just about anything related to OSD.

ConfigMgr Admin:

These staff need access to configuration settings, security, site systems, SUP & FEP etc.

Getting there

To achieve these requirements, we needed to use a mixture of Collection limiting, Security Roles, Security Scopes and Administrative Users (Groups).

First of all, we determined that we needed a collection structure that we could use for limiting device and user scope. Our Active Directory environment was already pretty well laid out, and as such, each site has its own Organisational Unit and Workstations sub-OU's.
I scripted the creation of these collections based on OU Name, using a query rule for the OU itself. This collection is limited to the All Workstations built in collection. We created two other base collections, one was called All Workstation Deployments, which had an include rule for the All Workstations collection. This one was to be used when targeting deployments. The reason for not using the All Workstations collection is that when you grant permission to a collection, you also get all the child collections (all collections based on a collection). The other base collection was 'All Test Workstation Deployments' which is based on an Active Directory group for deployment testing.

Next up, we determined that we needed some security scopes for the different states of package/application creation and deployment. We created:

Production Ready Applications
In Development Applications
SoE Applications

(We may add another scope down the track to limit things like FEP/SUP)

Now came the roles. We had already determined the support requirements, so we made some roles to suit those. In building the roles the RBAViewer application included with the ConfigMgr 2012 Toolkit was immensely helpful.

Role-SCCMRead - Providing read-only access to just about everything. This role was a copy of the Read-only Analyst built in role, with a few irrelevant items removed (irrelevant to our environment)

Role-ITStaff - Providing the ability to remote manage clients and update collection membership. This role was based on the Remote Tools Operator built in role.

Role-SCCMApplicationCreator - Provides almost the same functionality as the Application Author role on which it as based, we removed a few permissions like being able to change the security scope of a package or application as well as a couple of other changes. (The Application Author role has 7 more permissions)

Role-SCCMApplicationDeployer - Grants the permission required to deploy an application to a collection. This role was based on the Application Deployment Manager - removing 23 permissions, mostly around Alerts, Boundaries and Boundary Groups.

Role-SCCMSoEAdmin - Is a copy of the built in Application Administrator role. We didn't make any changes, but decided to make a new role anyway so that we could easily add or remove permissions down the track as we see necessary.

With the roles created, all that was left was to create the Active Directory Groups, and then add them into the console.

For easy identification, we named the groups the same as the Roles, with the exception of the Role-ITStaff.

This group is a bit different, because, there is one for each of the sites that contains the IT staff that look after that particular site.

Here's how the Administrative Users/Groups ended up:

Role-SCCMRead - This is the base role assigned to a front line support person. It has a Security Scope of Default, and a base collection of All Workstation Deployments. This collection scope allows the staff to see all collections based on this collection.

TTX - IT Staff - there will end up being 230 entries for these groups, one per site. This allows us to scope a front line support person to their specific site(s).

As you can see from the screen shot, the group is set to only be assigned to instances in the security scopes and collections. Here I have added the Default Scope - which doesn't contain much, and the Workstations collection that is specific to that site. The role assigned is the Role-ITStaff role.

Role-SCCMApplicationCreator - This role is assigned the Security Scope of Application Development. This scope will be applied to all applications created by the user in this group. What this means is that applications in this specific scope, can only be deployed to collections within the All Test Computers collection. This is how we distinguish between production and development applications.

Role-SCCMApplicationDeployer - Users with this role are able to deploy applications and packages that have been assigned the scope of Production Applications. They can do so to only the All Workstation Deployments collection, and sub-collections of this. This does still leave some room for error. I'll let you know or way around that shortly.

Wrap Up

This gets us to the end of our quest for secure and safe in the console.

Except, as i mentioned, the Role-SCCMApplicationDeployer still has a fair amount of scope for error.

To alleviate this, we have devised a plan whereby, once the Application Creator has finished their part, they log a service request in System Center Service Manager, this service request is then approved/denied by one of the SoE Admin team based on their check of the package. If approved, the service request initiates a runbook in System Center Orchestrator. This runbook takes care of the following steps:

Creates AD Groups if they don't exist.

Creates Collections, with Query Rules targeting the newly created AD Groups.

Create a Deployment Rule targeting the newly created collection.

Service Manager then emails the requestor with the group name, which they then add their machines to, and the software is deployed to the clients as desired.

This removes the scope for error that we have with people deploying software manually. It also brings us some standardisation of naming and collection evaluation scheduling.

Of course, this wont work for every situation, but for the majority, it should suffice.

We have around 1000 differenet applications being deployed in ConfigMgr 2007 at present, we hope to cut that back a bit in 2012, but, for now this is the plan!

ConfigMgr 2012 SP1 - Findings on Discovery Methods

2013-06-28T11:51:00.001+10:00

As I was changing some discovery paths in Active Directory * Discovery, I noticed that the polling schedule was set to every 7 days, and that delta's were enabled for every 5 minutes.

This lead me to explore what it was discovering in these Deltas, and to check if I should increase the frequency of full discovery.

Enabling Delta Discoveries means that it checks every 5 minutes (by default) for changes or new objects.

Let's explore this...

New objects, well that's easy, but what is it that represents a change?
According to the logs created by the ad discovery agents, it appears that the search is looking for objects matching specific search criteria.

User Discovery

Here's an excerpt from the User Discovery Log adysrdis.log:

INFO: Previous highest committed USN = '48704'
INFO: New highest committed USN = '48706'
INFO: Search provider = 'LDAP'
INFO: Domain controller = ''
INFO: Succeed to cached binding for LDAP://TTDC01.tassietech.local/RootDSE
INFO: Include groups option will be ignored during incremental discovery.
INFO: search filter = '(&(uSNChanged>=48704)(|(objectCategory=group)(&(objectClass=user)(objectCategory=person))))'

So what is this uSNChanged attribute? It seems to be the key to the discovery of changed objects.
From the MSDN article, USN value assigned by the local directory for the latest change, including creation.
and Update Frequency - When the object is changed.

Pretty blunt isn't it! I thought so.

That means, ANY change to an object, increments the uSN which in turn, causes load on your ConfigMgr server as it has to parse that change, no matter how trivial.

A few things to note from the above log entries, the search has knowledge of where it left of last time it scanned. It also has already queried AD for the latest uSN - this will be used as the starting point in the next query.

The search also says that it is going to ignore looking at groups during the incremental discovery. This means that any group changes are not going to be discovered during this search.

In these cases, the user is still flagged as changed, but the group membership is not evaluated.

This made me think about group discovery deltas.

Group Discovery

Jumping into the Group Discovery log (adsgdis.log) I saw that it clearly states that is IS doing a recursive search during the delta.

Here's the relevant entries from adsgdis.log:

INFO: Previous highest committed USN = '48723'
INFO: New highest committed USN = '48729'
INFO: Search provider = 'LDAP'
INFO: Domain controller = 'TTDC01.tassietech.local'
INFO: Succeed to cached binding for LDAP://TTDC01.tassietech.local/RootDSE
INFO: search filter = '(&(uSNChanged>=48723)(&(objectCategory=group)))'
INFO: ads path = 'LDAP://TTDC01.tassietech.local/OU=GROUPS,DC=TASSIETECH,DC=LOCAL'
INFO: Bound to 'LDAP://TTDC01.TASSIETECH.LOCAL/OU=GROUPS,DC=TASSIETECH,DC=LOCAL'
INFO: successfully completed directory search
INFO: Start to recursively process into group objects
INFO: Finished recursively processing into group objects

So, even though the User Discovery agent isn't looking at groups - as long as group discovery is enabled, that will.

Unfortunately, my small development environment doesn't have the AD load to replicate a high change load in ConfigMgr.

I've had a thought about how I can replicate a busy AD using PowerShell. If time permits one day, I'll knock it up and give it a test.

When we go start deploying to production, which is a VERY busy AD, we will soon see some load data.

I'll post soon on how the above works in conjunction with Collection Evaluations.

ConfigMgr 2012 SP1 - Getting around the certificate issue with the Add-CMDistributionPoint cmdlet

2013-06-27T14:15:00.000+10:00

You may remember, back here I was having an issue with reusing a certificate that had already been imported into the ConfigMgr console.

So after some lengthy testing and discussion with Microsoft Support, we came up with the following workaround.

It involves generating a certificate per server (distribution point) that is deployed.

Here's the Script that does the deed:

Set-Location -Path cert:\LocalMachine\My

Get-Certificate -Template CM12PXECert -Url ldap: -SubjectName CN=FQDNofDP

$secure_string_pwd = '$omethingH@rdT0Gue$$' | ConvertTo-SecureString -Force –AsPlainText

Get-ChildItem cert:\LocalMachine\my | where {$_.Subject -match "CN=FQDNofDP"} | Export-PfxCertificate -FilePath C:\windows\temp\FQDNofDP.pfx -Password $secure_string_pwd

Set-Location -Path cert:\

Get-ChildItem cert:\localmachine\my | where {$_.Subject -match "CN=FQDNofDP"} | Remove-Item -DeleteKey

This script basically requests a new certificate from the Certificate Authority, Exports it, along with the required private key - secured with a strong password - to a pfx file that is needed by the Add-CMDistributionPoint cmdlet.
Next the script goes and deletes the certificate from the server that it was added to, in this case, its the Primary ConfigMgr Server.
Note: Ensure that the server account has the required permission on the certificate template to request a new certificate, not just the user running the script!.

While this wasn't what I had originally envisaged, it turns out that this a better practice solution anyhow.

That said, I still think there is a bug in the CmdLet (s) because if I had to rebuild one of these deployed distribution points, I would like to think that I could re-use the exported certificate, rather than generate another for the same box!

Watch this space, hopefully there will be a hotfix for the issue, or a fix in a service pack.

ConfigMgr 2012 SP1 - Upgrading Clients with Cumulative Updates

2013-06-25T10:43:00.000+10:00

As CU2 has just been released, I thought I would drop a quick note here to say that when you go through and upgrading your hierarchy you need to remember that even if you check the box next to 'Automatic Client Upgrade', it wont happen! (And it doesn't matter how many times you open and close the console, that Latest Version variable just wont update :) )

Automatic Client Upgrade will only update major versions, like a Service Pack, or R2.

If you look at the console you will note the version number:

Before CU2

It is still set to the last Major version. In this case, Service Pack 1. (CU1 is installed - but there is no version update for this here either.)

After CU2 is installed:

After CU2

Same story. If you want CU2 on your client fleet (which you should), then you need to deploy it using the normal methods, like Deployments, WSUS, Group Policy, etc.

Version Notes:
SCCM 2012 SP1: 5.00.7804.1000
SCCM 2012 SP1 CU1: 5.00.7804.1202
SCCM 2012 SP1 CU2: 5.00.7804. 1300

ConfigMgr 2012 SP1 - Installing CU2

2013-06-25T10:40:00.000+10:00

I thought I would document the process of installing CU2 in my small development environment.
Warning: This may be a case of death by slides.

You can get the CU2 upgrade from here: http://support.microsoft.com/kb/2780664
Note: It includes all the updates for CU1 as well, so you don't need to apply CU1 before CU2.

Primary Server Upgrade

Errors and warnings will be shown on the prerequisite check page, they are fairly self explanatory as can be seen in the following image.

Once you have met all the prerequisites, you will be able to proceed with the upgrade.

I chose to upgrade the console at the same time

You can either let the upgrade process upgrade the database for you, or you can do it later. Either way, back it up first in case something goes wrong.

I chose to create packages for Site Servers, Console and Clients. These are automatically added to the console ready for distribution and deployment.

You can set the destination path for the source files, as well as specify names. I left the defaults.

The summary presents you with all the information you have provided to the wizard, ready to go!

The upgrade will take a few minutes, depending on which tasks you selected.

Once complete, you will hopefully see the Successful status for each action.

To Check that the CU has installed, you can check the registry key:
HKLM\Software\Microsoft\SMS\Setup\CULevel. CULevel should equal 2 as shown below.

CU2 Installed on Primary!

You should also check that the console has upgraded, as some of the fixes in CU2 are console related.

You should see 5.0.7804.1300 after installing the console update.

Console Updated on Primary

Upgrading Other Site Servers
If you have any other site servers, or consoles, these will need to be updated as well. You can either do that manually, or you can create collections and deployments to push the updates out.

I don't have any others in my environment, so no more work required here...Onward...

Client Upgrade

Now that I have the primary site upgraded, I need to go and push the new client out to all the other devices.

As can be seen from this screenshot, I didn't push out CU1 to the clients yet.

The next step is to take the packages that have already been created by the upgrade process (if you selected for them to be created) and push them do your distribution points.

I then made a collection for all SCCM Clients

Next up, I just deploy the new CU2 upgrade to this collection, making it a required installation, that is to take place as soon as possible - I don't have any users to worry about in this dev environment.

Next sit back and wait, or if you are like me, head over to the monitoring section, and watch the deployment progress.

That's about it!

I only covered the deployment of the x64 Client, To deploy the x86 one, you could edit the x64 package to target 64-bit versions of Windows OS, and then edit the x86 package to ensure it only applies to x86 versions of Windows, and then deploy it to the same collection.

ConfigMgr 2012 SP1 - Limitations of the Get-CMAdministrativeUser CmdLet

2013-06-24T13:58:00.001+10:00

While writing up a PowerShell script to add Administrative Users to our ConfigMgr 2012 environment, I found that using the Get-CMAdministrativeUser CmdLet does not work for 'Groups'

Let me explain.
In the console, you can add either individual Users from the domain(s) or you can add an AD group. To reduce the administrative overhead, we were predominantly using groups, all of which had been done manually to this point.
Each Group or User can have their own individual permission sets so that we don't have the old 'too many cooks' scenario.

I wrote up a PowerShell script to Create our Groups in the console from a csv file that had the name of the group - from AD - as well as the collection that I was limiting the administrative rights to.
To make the script more robust, I wanted to first call Get-CMAdministrativeUser to determine if the group had already been added to the console. Unfortunately, here's the crunch, this cmdlet does not retrieve Groups, as the name suggests, it retrieves only Users when using the -Name parameter!

The syntax for the Get-CMAdministrativeUser cmdlet is:

Get-CMAdministrativeUser [-Name <string[]>] [-RoleName <string[]>] [<CommonParameters>]
Get-CMAdministrativeUser -Id <string[]> [-RoleName <string[]>] [<CommonParameters>]

If you knew, somehow, the ID of the user, then you could pull the group without any trouble.
Another alternative is to use a command like this:

Get-CMAdministrativeUser | Where-Object {$_.LogonName -like "*GroupName*"}

What I ended up using was a simple WMI query as this turned out to be the quickest method.

Get-WmiObject -Namespace "ROOT\SMS\Site_$SiteCode" -Query "Select * From SMS_Admin Where LogonName like '%GroupName%'"

If you try to add a User of Group that already exists, you get the error:

WARNING: This user is already assigned as a Configuration Manager administrator. Select another user or security group.

The full script that I ended up with is this:

Import-Module ($Env:SMS_ADMIN_UI_PATH.Substring(0,$Env:SMS_ADMIN_UI_PATH.Length-5) + '\ConfigurationManager.psd1')$PSD = Get-PSDrive -PSProvider CMSiteCD "$($PSD):"$SiteCode = CMSite | Select SiteCode
$csv = Import-Csv C:\Files\adminGroups.csvForEach ($Line in $csv) { $ADSamAccountName = $Line.SamAccountName.Trim() $CollectionScope = $Line.CollectionName.Trim() $SecurityScope = "Default" $RoleName = "Role-BasicStaff"
$adminIfExists = Get-WmiObject -Namespace "ROOT\SMS\SITE_$SiteCode" -Query "Select * From SMS_Admin Where LogonName like '%" + $ADSamAccountName + "%'" If ($adminIfExists) { #Only Create if it Doesn't Already Exist If (-not($adminIfExists.RoleNames | Where-Object {$_ -like $RoleName})) { Write-Host "Adding Role to Group: $ADSamAccountName" Add-CMSecurityRoleToAdministrativeUser -RoleName $RoleName -AdministrativeUser $admin } } Else { #Admin Doesn't Exist, Create a new one $NewAdmin = New-CMAdministrativeUser -Name $ADSamAccountName -RoleName $RoleName -CollectionName $CollectionScope -SecurityScopeName $SecurityScope }}

This script also checks the AdminUsers current Roles, so that we can apply the required role if needed.
Using this, we can now go and create our 230 security roles to cover each of our sites.

ConfigMgr 2012 SP1 - Another issue with the Add-CMDistributionPoint CmdLet

2013-06-21T11:24:00.000+10:00

Here we go again, we've come across another issue, although this one is not so bleak.
I happened to stumble across a tweet this morning that ended up saving the day!
We had deployed a DP using the Add-CMDistributionPoint CmdLet that was introduced in CU1 during our automation process.

The issue was that when the DP Client was trying to download and install a package (in this case, the ConfigMgr Client Upgrade for CU1) it looked to be trying to get it from the Primary Site Server, instead of the local DP.
In the logs, it appeared like the it was doing the right thing, however the path to the file was wrong. Luckily, the drive letters used for content source is different from the Local DP to the Primary Server DP otherwise we may not have noticed the issue for even longer.

The issue was that the client had an incorrect fqdn for the server it was supposed to get the data from. This was due to a bug in the CmdLet that specified the REMOTE server instead of the LOCAL server.

There is no patch for it yet, but the MS KB article that was posted only last night had a simple VB script that could remedy the issue.
If it wasn't for the tweet, I may not have found this for a lot longer!

References:
http://blogs.technet.com/b/configurationmgr/archive/2013/06/20/kb-the-add-cmdistributionpoint-cmdlet-in-configuration-manager-sets-an-incorrect-serverremotename-value.aspx

http://support.microsoft.com/kb/2860244

ConfigMgr 2012 SP1 - Certificate Issue with Add-CMDistributionPoint in CU1

2013-06-21T11:15:00.000+10:00

During our quest to automate the provisioning of our ConfigMgr 2012 Distribution Points, we discovered an issue with the Add-CMDistributionPoint CmdLet that was introduced in CU1.

As we are using a PKI environment, we need to specify the correct certificate and certificate password when deploying the DP.
Here is the command we used:

Add-CMDistributionPoint -SiteSystemServerName $DPServer -SiteCode $siteCode -CertificatePath $DPCertPath -CertificatePassword $ssCERTPwd -MinimumFreeSpaceMB 5000 -AllowPreStaging -PrimaryContentLibraryLocation "M" -PrimaryPackageShareLocation "M" -EnablePXESupport -AllowRespondIncomingPxeRequest -EnableUnknownComputerSupport -ComputersUsePxePassword $ssPXEPwd -EnableMulticast -EnableValidateContent

This worked fine on the first test. We then removed the DP Role from the test server, and went to run the script again to ensure it was still working correctly. We uncovered the following error:

WARNING: The certificate you specified is already in use. Are you sure you want to use this certificate?Add-CMDistributionPoint : Validation of input parameters failed. Cannot continue.At line:1 char:1+ Add-CMDistributionPoint -SiteSystemServerName $DPServer -SiteCode $siteCode -Cer ...+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidArgument: (Microsoft.Confi...ionPointCommand:AddDistributionPointCommand) [Add-CM DistributionPoint], InvalidOperationException + FullyQualifiedErrorId : ValidationError,Microsoft.ConfigurationManagement.Cmdlets.HS.Commands.AddDistributionPoi ntCommand

Unfortunately this warning occurs for ANY system that uses the same certificate.
When using the console, the wizard prompts with a the same warning, but gives you the Ok button to proceed.
The CmdLet however, does not seem to provide any method for continuing.
I've now posted this issue on the Microsoft forums in hope that we might get an answer or workaround there.

Forum post here - In the hope it gets a fix: http://social.technet.microsoft.com/Forums/en-US/3e3fc3ce-6294-47c4-88d2-94bb60363141/certificate-issue-with-addcmdistributionpoint-cmdlet#3e3fc3ce-6294-47c4-88d2-94bb60363141

ConfigMgr 2012 Migration - Hierarchy Explanations

2013-06-11T20:30:00.000+10:00

After re-reading my previous post, I thought I should post up why we have designed our CM12 implementation in this manner.

First off, we wanted this baby to be as Highly Available as possible. The whole system lives in a auto fail-over data center, which on its own provides one level of HA, but this on its own isn't enough.

We have ~55,000 devices in the environment today - and this number is still going somewhat in the upward direction. There are also around 150 console users that will need to create/deploy packaged and manage the clients. These admins are located all over the state, connecting through all sorts of WAN links.

There is a possibility that a CAS may be used in the future, but thanks to CU1, we don't need to implement that now. We will also be deploying this as a PKI environment, our CM07 was not native.

Ok, let me explain the why's of each role in the hierarchy.

Primary Site System
As we have under 100,000 clients, and don't believe that we will get to this number, we only need one primary. Adding in another one would require us to add a CAS. All this adds an extra layer that just isn't needed.
This Primary Site will also be responsible for the Application Catalog (and web part). This component is not a high load one, and it wasn't worth splitting it off to another server at this time. A great benefit of CM12 is that roles can be moved around as needed.
This server will also house the Fallback Status point, and be the SMS provider.
The SMS Provider role is the only one here that reduces our fault tolerance.

Management Points
We are deploying three Management Point Site Systems to support our fleet. Each MP can handle 25,000 clients. Do the math, we need three.
These are auto load balanced, so no NLB required here.

SQL Cluster
The decision was made to house the SQL Database for the site system on a SQL 2012 cluster. This again was for high availability and manageability.
The most important thing when considering your SQL is Disk IO. The faster your disks, the better.
Disk performance is the one thing that can really bring your CM12 environment to its knees.

Software Updates Points
After doing some careful reading, we have gone with using two SUP's in this hierarchy. These will be behind an NLB, even though they can auto load balance. The reason for this is to prevent flooding any WAN/LAN links if and/or when clients loose sight of a SUP and decide to switch to the other one.
We could have gone with a single SUP, but updates are pretty important, and we like our fleet to be as healthy as possible, hence the two for high availability.
If a client looses connection to its SUP (they hold them until they fail) it will switch to a new one, and pull down around 4MB of catalog data. doing the math on this meant ~25,000 clients at 4MB each totaling ~95GB of traffic that we just don't need!

SQL Server Reporting Services (SSRS)
This service will be housed on a box of its own.
Reports can be slow at the best of times, and we wanted to ensure that it didn't impact on anything else, or that nothing else impacted them.

Distribution Points / State Migration Points
All DP's will be PXE enabled for operating system deployment
Most sites will have their own Distribution Point so that WAN traffic is not impacted.
Some small sites will not have a DP, and we may implement branch cache depending on load.

All these ideas were taken straight from the Technet Supported Configurations as well as from the MMS2013 Videos.
We also read through these books to get as much information as we could:

Now that we start to build and deploy, I'll update if anything changes!

Glad to answer any questions you may have on the why's and or how's :)

Migrating ConfigMgr 2007 to 2012 SP1

2013-06-11T14:35:00.004+10:00

At work, I am currently involved in the migration of our ConfigMgr environment from 2007 to 2012 SP1.

This is by no means a small feat!

Current Environment
Our current environment has around 55,000 clients and is still growing. There are 230 ConfigMgr 2007 Secondary Servers, each acting as a distribution point on a Server 2008 R2 box, which also acts as the sites DHCP/DNS/RODC/FILE&Print server. These sites are spread across the state (yes, I know Tasmania is only 500Km's across!) to provide local sources instead of using the slow WAN links.

Our current 07 hierarchy utilises a single SQL cluster, and 2 primary sites systems. One is used as a central administration server to handle the bulk of the processing, and the other is used for client assignment.

I've been doing heaps of reading and research into how we can best implement our 2012 architecture. That involved watching HEAPS - almost all - the MMS 2013 ConfigMgr, Orchestrator and Service Manager videos, reading as many blogs as possible, and taking part in an ConfigMgr 2012 course.

The Future
We have decided on the following structure:

This will give us a lot of flexibility, as well as a degree of fault tolerance. Instead of deploying secondary sites as we did in 07, we will simply make the existing CM07 Secondary Servers into CM12 Distribution Points & State Migration Points. This provides all the functionality that is required at these locations (as well as the other roles they had)

The Challenges
Implementing a new Collection structure to enable scoping for role based administration.
Re-packaging as many of our existing 1700 applications into App-V 5 applications as possible.
Provisioning just the right amount of access to our techs.
Getting the Orchestrator runbooks to work perfectly!

Work on the migration has commenced, and we have been busy provisioning servers for pre-prod and prod.
As usual, I built a small development environment using Server2012 and Hyper-V - then VMM 2012 SP1 - to do some testing and to gather some hands on before we get it into a live environment.
In the dev, I have deployed, CM12SP1, Service Manager 2012 SP1, Orchestrator 2012 SP1 and a couple of clients and test servers.

The aim here was to see how we can best automate our deployment of the 240 distribution points, as well as the removal of the CM07 secondary site roles and files.

I have almost finished writing up the runbooks in Orchestrator to handle the full deployment of the CM12 DP's as well as perform the cleanup of CM07. Just putting them through some rigorous testing.

An Orchestration Appetizer:

Control Deployment of DP

The end goal is to have this implemented as a service request from Service Manager 2012's Web Portal where a local site tech can simply fill in a few boxes, with pre-filled data, and schedule their sites' migration to happen without a single touch - awesome!

Stay tuned, I'll write up how the Orchestrator runbooks work in the following days!

AuTechEd 2012 - vFuture :: Config Manager 2012 SP1 - Behold the AWESOME!

2012-09-14T14:45:00.000+10:00

Here we are at the last session for our TechEd 2012 experience!
James Bannan is presenting this one with Macca and it is set to be a look into the SP1 for ConfigMgr 2012 which was only just released this week in beta!

#SIM334a is the hash/id of this session, in case we want Google to find it :)

This is the first presentation on SCCM 2012 SP1....In the world! Isn't that amazing!
..is this history in the making...tell your children if you were there! :P

So being a beta, things could change in the final release...hey, maybe it will even get better!
Once there was SMS 1.0...where you couldn't really do much..
Then there was SMS 2.0 which improved a little.
Next in line was SMS 2003R2
Along came ConfigMgr 2007 and changed the way we thought of SMS.
Intune came around in 2011 and confused everyone!
Now, we are at ConfigMgr 2012 with SP1 on the edge.

SCCM gives users empowerment, reduces costs by unifying management infrastructure, and improves effectiveness and efficiency.

SP1 brings the following features/additions for empowering users:
Support for W8, W8 tablet.
Mac OSx 10.6/10.7
Linux and Unix
Windows to Go
App-V 5 support
Application delivery:: modern applications, deep link applications and network cost support enabling metered realisation.

Linux and Unix support in SP1 is Server based OS's only!
It adds:
Hardware Inventory

Software deployment
- Package and Program model only.
secure authenticated communications
consolidated reporting.

MacOSx
Hardware inventory
software deployment via standard mac package formats.
compliance
patch management
consolidated reports

Upcoming Enhancements:
Flexible hierarchy management
- Ability to add a new central admin site
- Migration between ConfigMgr 2012 hierarchies

Hierarchy easier to control:
- SQL server distributed views.
- Schedule replication for a given link.
- Compression for SQL server data on a per link basis - (A tradeoff is higher cpu usage)

Setting management: user profile and data management
- Client Side Caching
- Roaming User Profiles - DCM settings around this to catch issues!
- Folder Redirection - Where do folders redirect to?

In Simplifying the GUI:
- There is now a PowerShell module - if its in the GUI, its in PowerShell too.
- Role-based administration
- Client Health
- Asset Intelligence
- Remote Control

Endpoint Protection Enhancements:
- Windows embedded support
- New actions from ConfigMgr Console. To take action for all clients with a specific malware infection, or remediation status - IMMEDIATELY!
- Support for maintenance windows
- Software updates integration improvements. to allow for more frequent distribution of updates.
- Client-Side Merge. If multiple policies are deployed to a client, the rules merge!

Windows Intune
- AD integration into Intune from ConfigMgr
This is as a compliment to ConfigMgr, not a one or the other basis.

Woot! - What a feature packed update from the Microsoft Team!

A new feature of OS deployment is that you can define when a Task Sequence is available to clients. Either PXE clients, or ConfigMgr Clients.

In Applications, you can add OS X applications. (This doesn't really appeal to me, but hey, it's there!)
There is also a new addition of being able to add Windows Store apps. At the moment, you can't deploy these, but it can report on the content. Quote by James "you can put it in the console and say wooo!"
When creating a new application, you can add FAR more applications than before, Google Play files, wow, what a list.
The App-V 5 support is a major new feature, No more need for the Q: drive!

James flicks to a Mac OS X screen...Has this ever happened in a Microsoft Event before!?? The OS X client is actually running the FEP client too.
(I'm not going to write much up here about the Mac management, except to say that these will only be Internet managed clients, so this means PKI certificate managed environment.)
There are a number of tools provided with the ConfigMgr client for Mac that help with the enrollment, installation, and package creation/management. All of which only can be done whilst using a Mac. You can't create a Mac package on something that isn't a Mac!

ConfigMgr 2012 SP1 also allows the provision of distribution points in the cloud. This utilizes Azure as storage space. So if a client cant talk to a local Distribution point, it can talk to the cloud to grab the data that it needs! This will be a great feature for managing those clients that go off site frequently, and often need updates, new software, etc whilst on the go.

Yet another cracking presentation by James and Macca. This was a detailed, informative, inspiring first look at the new features and enhancements that SP1 for ConfigMgr 2012 brings!.
What a great TechEd experience. If only I could do it again....one day... :)

AuTechEd 2012 - Private Cloud Service Delivery and Automation with SC2012

2012-09-14T10:47:00.001+10:00

Here we are at the last day of Microsoft Australia's TechEd 2012 event.
This session is being presented by Chris Thurtell and Toby Alcock.

They are delving into standardisation, self service and automation of processes. This is to reduce total cost of ownership, make the tech life easier!
The idea is to look for the simple every day tasks, and automate them. As you go through this, you optimize the processes and reduce effort.

There is a real emphasis on using the System Center 2012 suite together, integrated, to drive the whole service delivery platform.

There are three key elements to enable service delivery and automation:

Standardize the requests. define the services offered, identify who is involved and create templates to fulfill the requests.
Self Service. provides controlled empowerment, request offerings based on user role, intuitive, and reporting
Automation. Notifications, automate fulfillment, automate routing and approval.

To facilitate this, SCSM is used as a core CMDB, that is referenced by the service catalog (SCSM Portal). The correct change management approval processes can be triggered from here. After that, an Orchestrator run book can be triggered to fulfill just about any request in a completely automated manner. This results in a much better experience for the end user, and a greatly reduced risk of error, and increased possibility for accurate repeatability.

Quote: "The first rule of any technology used in a business is that automation applied to an efficient operation will magnify the efficiency"

Where do we begin in getting some automation into our service delivery processes:

Visualise the process. Draw it out!
Build Templates - with variables - define how each type of request may look.
Build Activities - these are the runbooks that actually make the process automated.
Build the runbook activities and link them into SCSM.
Build a service request template.
Build the Request offering for the portal.
Build and offer the request offering using user roles for security, and categories.

Automated Processes in 6 Steps:

Build
Import
Publish
Create
Invoke
Monitor

Recommended Download: Cloud Services Process Management Pack. Contains a heap of templates, runbooks, workflows etc that could be used to get you started with your own environment.

Another great informative session :)

AuTechEd 2012 - Migrating from ConfigMgr 2007 to 2012!

2012-09-13T16:35:00.000+10:00

Here we are, this will probably be my last session for today before the HYPED party.

In this session, James Bannan from Diliginet is going to go through a demo on how to migrate from a Configuration Manager 2007 environment to 2012. This is something that is really grabbing my attention at the moment. The more I hear and see of CM2012, the more I can't wait to have it in our own work place! Getting the migration right is critical to the success of the product for us. So hopefully James has some tips on how to get it 'just so'!

Overview
For the Demos James had configured 2007:
Single Primary Site w/DP Role
Separate Site Server w/DP Role

2012 with:
A Single Stand-Alone Site Srever w/DP Role
Configured for https only!

You can migrate:: collections, apps, queries, relationships, OSD & drivers, Task Sequences, Software Updates & Clients
You can also upgrade DP's, provided that is the only role installed, and it isn't a shared server.

Pre-Migration Tasks
setup all Cm12 server roles. and verify that the hierarchy works as expected. Configure SUP and sync updates (just meta data so that you can migrate from 2007)
Install a package conversion manager to upgrade legacy (CM07) packages to make applications.
Connect to CM07 hierarchy so that the CM12 site server can grab metadata from the old system. This just copies metadata, and is non-destructive. Then, enable DP sharing, only a shared DP can be upgraded from CM07 to CM12.
The CM07 server is linked as a Source Hierarchy.
Only a secondary site server can up upgraded, however it isn't a true upgrade, its an uninstall, then install...

When a client agent is migrated, the execution history is maintained. This is so that when the client appears in CM12, it doesn't have to re-run the applications that are already installed.
When a client is migrated, the old agent is uninstalled, and the new agent installed and started, a reboot is not required. This means that you can do a migration during business hours.

Hierarchy Migration
In migration, dependencies and relationships are recognised, and are automatically brought across to the new environment. This means you really need to asses what you need to bring over to the new environment. For example, bringing in a collection for a software install will bring in all the related sub-collections, queries, boot images, OS images, software packages, advertisements etc.

Quote form James: "I don't have demo fails, I have unscheduled learning opportunities"
After a quick recovery, all was good. (the issue encountered was that after migrating a collection - with packages and adverts - you need to re-run a data evaluation on the shared dp for it to know what has changed)

When you migrate a large number of items, the console may need to be closed and re-opened before they are displayed. This seems to be a bug with the console during migrations.

The migration process does not bring across anything that you will need to manually remediate before it will work. It just works.

Client Migration
If you are using PKI in the new environment, then the client must have the cert prior to migration. Otherwise it won't work. If you are not using PKI in CM07, you should roll out the CM12 cert to clients prior to migration.

Post Migration Tasks
After a migration you will need to look at your packages, and upgrade them. This can be done with the Package conversion manager.
Next is to upgrade the DP's to CM12. This is a no return upgrade. This upgrade will DELETE the CM07 server out of the hierarchy.
Replace the secondary sites with simple DP's. There is no need to roll out a secondary type site with CM12.
Finally, decommission the CM07 primary sites.

This was a fantastic session presented by James, it would be great to have James come and look at our environment and provide us with some guidance. He really knows what he is talking about, and is switched on, with real world experience!

OK, I'm ready to get CM12 going at work....I hope it can happen soon!

When the session videos are uploaded, and the slides, I will add a link to them here.

AuTechEd 2012 - FIM Best Practices

2012-09-13T11:27:00.001+10:00

I just finished a session on Forefront Identity Manager (FIM) presented by Carol Wapshere. Before this session, I had just about no idea about FIM, but afterwards, I have a much better understanding of what FIM is, what it does, and the potential to integrate our identity stores and to maintain accurate, relevant data!

Carol displays a huge wealth of knowledge on the topic of FIM, with a lot of experience in working with customers in developing and deploying an identity system for their needs.

Some points that came out of it for me, not especially related to FIM, but to projects in general, was that we need to implement a full production data set in DEV and TEST (and to ensure we have a DEV and TEST!) so that testing can be at full scale, and not some idealistic best bet approach. The other fact was that the DEV and especially TEST should run on the same or BETTER hardware than that of PROD! The reason being that the likelihood is that in TEST, you will be running the syncronisations, and 'tests' much more often than would happen in a PROD environment.

FIM can integrate with just about any data storage system in your environment, and synchronise the data stored there. The important thing to realise is that there can only be one definitive data source for a given attribute. For example, you can't have two data sources for a users' name.

I look forward to the second session on FIM which is now just moments away! I won't be writing a post up for that as it is a level 400 talk, and will probably be demo intensive. I will be a bit busy consuming the information presented to be able to type anything useful.

AuTechEd 2012 - Enabling Mature Self Service with SC2012

2012-09-13T09:22:00.002+10:00

It is set to be another packed day at AuTechEd 2012!
I am starting out my day at the 8:15am session on Self Service with System Center 2012.
(Again, I am writing this live in the session, so sorry about the randomness.)
Presented by Justin Cook and Jeffery Cook
The session begins by looking through a traditional IT service process. It highlights current practices like phone calls, manual tasks, high workload, no real self service.

Going forward, it looks at empowering the users by letting them do things for themselves. This also reduces the time it takes for them to get their needs met.
IT staff will have reduced effort, and the cost is reduced. This time saving, allows IT staff to look at innovative technologies! (Dream come true? Proactive vs Reactive)

Configuration Manager 2012 has a Software Center (client software), as well as a Application Catalog (Web Page) to provide an end user with managing the software that they want installed.

One great thing about the Application Catalog is the ability to manage software requests. Not all software is free, so sometimes, we need to track, monitor, and restrict who can have it. With SC2012 CM, we can tick a box to set an application to approval required. When a user visits the catalog, they can request the software, providing a reason, message with it. The IT person, can then view these requests in the CM console, and approve, deny etc the request. After this, the user can select to install the application from the catalog.

There are two approval workflows, one is the built in approval workflow in CM. This has some limitations though, like Limited to console only and no email notifications.
The other method is to use Service Manager (SM). The benefits of this are, that it is synced to the CMDB, it creates a service request. This can then be delegated to the business unit responsible for the resource, and as well as that, there are email notifications!

The session delved into Virtual Machine Manager and AppController as well, but this is out of my scope for now, so I won't write it up here.

Next up was a brief run through of Orchestrator 2012. basically, this is used to automate our business processes. Things like, system commands, scheduled tasks, monitor processes or event logs, manage file interactions, send email notifications and modify data within the workflow on the fly!

The SCORCH web console can view runbooks, instances and definitions. It can also view runbook servers to see their state.
You can also initiate runbooks and enter parameters etc. View events, and a few other things. However, there are some limitations, so the console is much more powerful, as you would expect.

So, we have seen a lot of 'portals', do our end users need to visit all these distinct pages? short answer - No. We can facilitate all these needs from the SCSM web portal.
(NOTE: it was interesting that when the speaker asked how many people are using SCSM, I only saw about 4 hands, there are around 250 people in the room)

Justin next went through the reasons why SCSM is a good thing, I didn't notice anything new here as we have been using it for a while now!

The process with SCSM is:
a) the user visits the SCSM Portal, and requests the action/software
b) a workflow is triggered to do the approval process.
c) upon approval, a runbook is triggered to automate the fulfillment of the request
d) the end user is notified along the way of how their request is going.

This session is really showing me some possibilities for automating some of our processes. The SCORCH/SCSM demos were informative and interesting. I can't wait to get back to work to share some of the info I have seen and heard here with the team.

Top 5 Tips:
1) Orchestrator enhances service manager request offerings - don't deploy SCSM on its own, add SCORCH!
2) Use runbooks to automate review activities population - have a number of reviewers etc.
3) Provide notifications from within runbooks rather than from SCSM which has some limitations around notifications!
4) Extend the service request class with additional properties -
5) Config Items must be related to service requests, this makes the objects available to SCORCH in automating the request/service call.

Another tip, instead of targeting reviewers in the request or activity template, it is better to target them in the runbook to update the service request, based on a dynamic query like a job title, or AD group etc.

This has been a great start to today's sessions - great work guys!

AuTechEd 2012 - Best Practices for Orchestrator Runbook Authoring

2012-09-12T12:31:00.001+10:00

Session 3 of AuTechEd 2012 - This time, we are looking at the best practices for authoring runbooks for System Center 2012 Orchestrator (SCORCH).

This session was presented by Gareth James.

We have a mostly demo session this time, focusing on getting us familiar with creating a runbook in SCORCH.

(A runbook is basically a set of instructions that go into a process flow to automate a change/task)

Firstly, we should treat a runbook as code, so create dev, test and production environments. Check the code in and out so others can edit it. Versioning should also be used to ensure that changes are managed well. The only way a runbook should find its way into production is via an import, NEVER by editing the runbook live in PROD.
Keep a changelog (with the versions) to show what changed, and when. This way, if an issue occurs, you can find out what may have triggered the fail.

(TIP: In VMM, before you hit commit, you can view the code that is used to perform the selected action, you can copy this code and use it in SCORCH!)

The Tool: System Center 2012 Orchestrator Runbook Designer.

Some ideas around runbook authoring:
- Layout the various runbooks into neat folders.
- Name the Folders, and ACTIONS with meaningful names. Quite often the default names are not very descriptive about what the activity that is occurring.
TIP: the properties of the links from actions contain the criteria for the link to be followed. (NOT the action)
- Name the Links, the default name of 'Link' is not very useful.

Another TIP: You CAN'T change the link property filter to an 'AND' parameter, only an 'OR'. So to make this work, you need to use an include parameter, and an exclude parameter.

A great feature of the Runbook designer is the ability to create global variables. This is a great way to spell out commonly used values. Also, as you move between dev/test/prod environments, the variables can be specific to the environment that you are working in.

Make sure that you handle implement error handling in your runbook routines. This will greatly improve your ability to track down where the errors are occurring.

Make runbooks discreet and modular, link them together. Don't have runbooks that wait for a task to complete - especially tasks that you know will run for a long time.

This talk was aimed at people with more SCORCH knowledge than I have, but it did inspire me with the possibilities of what can be achieved in our own workplaces.

AuTechEd 2012 - ITIL and the Private Cloud

2012-09-12T10:52:00.001+10:00

Here goes my second Microsoft Australia TechEd 2012 session. It's 9:45am, and after just finishing the last session, I am looking forward to hearing and learning more. I am however, in need of a coffee, so will be looking forward to that at 11:30 when this session concludes :)

This session is about ITIL (Information Technology Infrastructure Library) and the private cloud and is being presented by Gareth James.

Change management is a decision making process where various factors are weighed up to acheive best outcomes for an organisation. Some of the factors are broken down to: Balance Cost, Benefit and Risk.
We need to Co-ordinate changes to minimize the impact to the organisation. this is a catch 22, as most changes are to bring about some impact. So the change, needs to be communicated, explained, and managed.

Changes should be evaluated to be able to improve the process next time.

Managing change can have three outcomes. The Good: less failures, and better communication. The Bad: processes are cumbersome, processes are not consistently applied and not enough standards. And The Ugly: Staff avoid the process altogether or accountability is hard to see which makes change hard to progress.

There was humor too: An example of a meeting that occurred 2x per week, where an employee was so revved up for these change meetings, that he slept and snored for the entire meeting.

So, ITIL in the cloud, is about providing automation in the provision of services. Taking out the middle man, reducing cost and increasing agility.

Some ways to make the change process work include:
- Integrating the process with the systems that we use.
- Having a process that is rapid and on Demand.
- Realising that not all requests are equal - the process has to fit the purpose.
- LESS MEETINGS!

In automating the change process, System Center Service Manger (SCSM) is the key component. When creating a change request, the reviewers can be set, so that the right people get to hear, and have input into the change being put in place.

By using SCSM, we can delegate the responsibility to those who need the resource. There can be limits placed on what and where the changes can be placed. For example, the provisioning of a virtual machine environment can be given to the team needing the resource.

By automating processes with SCSM, you will remove the human error and negligence resulting in smoother, more efficient and informed change.

Another informative session aimed at honing our change management through automating processes and making the change about the change, and not about the meetings and people involved in it.

AuTechEd 2012 - Becoming a Windows InTune Administrator

2012-09-12T09:31:00.000+10:00

This is my first TechEd session and I am writing this whilst listening to the talk.
The presenters for this one are Harris Schneiderman and John Pritchard.
We have been taunted that there is a surprise at the end...now I can't help but wonder what it can be...I'll have to wait to find out.

InTune is basically an SCCM-like product that is driven from the cloud.
It's update schedule is on rapid release cycles, meaning that new features and fixes are added quickly. One of the benefits of cloud based apps.
Enabling flexible work styles so that users can work from anywhere, and still connect to the InTune services.

There is a Free 30 day trial for 25 clients to get you into InTune and a 90 day trial for enterprise environments.

There are many deployment options: Manual, GPO, current deployment tool like ghost or whatever software installation methods you use in your environment already, self service via Sky Drive share.

Windows InTune has an endpoint protection Malware service available, it is a tune-able anti virus/anti Malware that is friendly for lower spec machines. You can turn it off if you want.
When Intune is deployed, it automatically uninstalls most other AV products silently! what a great idea! Its no good having multiple anti Malware products installed on your machines.

The deployment download is a zip file that contains the installer and the certificate. When deploying the client ensure that you cleanup post install to prevent theft of the certificate. If the certificate is used by someone else, they will use your licences, and the client will be controlled by your instance of InTune.

The console looks great, user friendly, and navigable! The reporting and monitoring is great, it pre-empts issues, and reports on things like when Java has a critical security issue, identifies the clients affected, and can update them.

InTune also allows for the creating of polices for devices, (even Ipad, Android apply). Group Policy, if present in the environment, takes precedence.

Deploying software with Intune is another great feature. It can install packaged files like msi, or exe. The package MUST be able to be installed silently. One negative, is that the software has to be uploaded, downloaded from the cloud. This may not be great for larger apps as you can imagine. The demo had a package (Office 365) that was ~600MB in the list. Software can be deployed to Android, Windows and iOS - How Cool! The actual software deployment is very similar to SCCM. The installation can be either mandatory, or optional.

Troubleshooting, there is quite a lot of resources on how to do something when you can't work it out.

Another great feature, is the Customer Portal web page. From here, your users can contact IT with a problem, install optional software or manage their own devices.

All up, this was a great intro to InTune. I think this is a great product, and its development is fast, and it provides a smooth management interface that is informative and intuitive.

Windows 8 RT will be supported by the next release of InTune.

The Surprise: It turned out that the surprise was about the next release of InTune. We are currently at Wave C release, next up is Wave D. SCCM 2012 SP1 Beta has been released, and it is integrated with InTune.

(Sorry if this isn't a very cohesive post, It was written quickly whilst trying to take everything in during the session.)

AuTechEd 2012 - Opening Sessions

2012-09-11T20:00:00.000+10:00

Here I am at Microsoft's annual Australian TechEd event for 2012 on the Gold Coast! The sun is shining outside, the conference center has huge windows all around, tempting us outside.
I am traveling with two work colleagues and we are hoping to learn some new things, be challenged in how we do our jobs, and be inspired to 'Stand On the Shoulders of Giants'.

Yesterday afternoon I attended the Windows Server 2012 opening session which I found interesting. For a low level topic it focused on Hyper-V and integrating with the cloud. From this session, it was clear that Microsoft had put in some hard yards to try to get Server2012 just right! The demo was informative, and I didn't get lost in the flow. The pace was perfect, and I do feel inspired and can't wait to get into Server2012 in our own environment, however the likely hood is that this will be a bit of time.

Next up was the main Keynote presentation by Jason Silva. Jason isn't a Microsoft person, and was there to present an inspiring and thought provoking presentation focusing on getting us to stand on the shoulders of giants. That is, to take the great Microsoft products (and others as well!) and to build on them. I found the presentation a bit fast paced for me, Jason speaks quite quickly, uses big words, and gets very excited! Unfortunately, to me, that means, too much info, turn off. I did find the couple of dance/music presentations quite cool.

All up, I cant wait to get into the sessions to come! It is a packed schedule, and should be a great week.

Living Tech: Digital Education Revolution - Conclusion

2012-05-08T18:40:00.000+10:00

In this post I hope to tie up the previous three posts regarding the DER rollout in Australia (hopefully you have been reading them!)

One of the biggest factors around DER is - will it continue? Will the government continue to fund this year after year? If not, how can these numbers of devices be retained, or, will something give and cause us to rethink methods and practices that have been put in place through DER.

In concluding the IBRS report came up with three scenarios that may provide some way of moving forward both with and/or without the DER's funding.

Scenario 1 - Student Ownership - 1:1
Under this scenario, there is a significant cost impact (around $650million annually) in providing every student in grades 9 to 12 which they effectively have as a personal type device. the estimated cost to do this from now till 2020 would be around $5.8 Billion on purchasing the devices alone. Then you need to take into account the costs of infrastructure or training of staff to use these devices and technologies effectively.

Scenario 2 - Managed School Assets
The ideas set up by DER of providing every student with a device won't fade, but maybe the approach should change slightly to providing every student with access to a device. This would be a much more sustainable and cost effective option. It would mean providing a ratio of roughly 1:3 instead of 1:1.
Some benefits of this model include being able to offer different types of devices for different tasks. For example, a video editing class could have higher performance machines than those required for Internet research tasks.
Providing all students through a school (all grades) with the same access means that that everyone has equal opportunity and access to resources.
Some surveys suggested that a 1:5 ratio would be acceptable in many schools, but as ICT was integegrated more into the classrooms a 1:2 ratio would suit better. This ratio effectively halves the costs of a 1:1 environment.

Scenario 3 - BYOD
The report suggests that BYOD on a large scale would not work in the public school environment. This would be due to the costs associated that are passed on to the families. For some cases, BYOD in the public school system could work well - but would need to be assessed case by case.
For private schools - this option could work really well, a number of private schools already have similar systems in place.
To make BYOD effective, it would be advantageous to provide families with a list of preferred suppliers and devices to ensure that students receive a device that is worthy of their investment.
The BYOD system can be managed in a few ways - one that I like in particular is the Windows-To-Go option, whereby you can boot a live USB stick of the school environment as if you were using any other school owned device. However, there is still some way to go with this. Other virtualization options are also available to ensure that everyone has access to what is required.

So, here we are at 1:1 in grades 9-12 and 1:5 or 1:8 in grades 7-8. With some uncertainty as to how this will continue, stop and think about what options there are. The above may give some ideas.
In my thinking and speaking with a variety of people, I feel that Scenario 2 would work quite well. Adopting the 1:3 ratio across the whole school, with a range of devices that are to be used for their purpose, such as web browsing, multimedia, document creation etc. This way, teachers can use an appropriate device for their lessons. Another factor is that adopting 1:3 would save approximately $400million per year.
Also, we should consider the way classrooms integrate and use technology. Classroom redevelopments should also evolve to enhance the technology that will be used in them. Things like power points, wireless access, space for a trolley or laptop storage are all major players.

I look forward to seeing how the next few years go in terms of devices for students in our schools. We have learnt a lot, now we need to put some of what we have learned into practice to improve the learning opportunities for our students.