config manager

Blog: ConfigMgr: DCM Configuration Pack Authoring Series

Tue, 10 Nov 2009 03:24:23 GMT

Simon has finished up a smashing 4-part series on how to create Configuration Packs to support the Desired Configuration Management feature of ConfigMgr 2007, including some great knowledge on some XML cleanup not published anywhere before now. Definitely enough here to get anyone going down the path of DCM Configuration Pack in Configuration Manager 2007.

Great work Simon!

Installments in the Series

Part 1: Creating DCM packs with SCCM 2007

Part 2: Creating DCM packs with SCCM 2007

Part 3: Creating DCM packs with SCCM 2007

Part 4: Creating DCM packs with SCCM 2007

RSS | TWITTER

Forums: Re: SCCM questions

Mon, 09 Nov 2009 19:56:34 GMT

Thanks for the replies. I looked at the link above, and while it explained about having to store and run NAP policies to the clients from the central or primary site servers, I could find no mention of whether or not the NAP has to exist on the site server itself or if you could enable NAP properties and point it to a separate server. In other words, does the central or one of the primary site servers have to be win2k8 in order to enable NAP in the SCCM environment, or can you have a win2k8 server in your environment and then enable NAP on there, because isn't NAP actually part of win2k08 and then SCCM utilizes it? Or does win2k8 have to be on a central, primary or secondary sccm site server? In addition, if I can utilize it on a server that isn't one of the SCCM site servers, can we utilize NAP later down the road, after the SCCM environment is established, or does it have to be enabled from the get go?

OK, now that I have beat that to death, re: remote assistance vs. remote control. We currently use remote assistance, because it was determined that remote control posed a security threat. I am under the impression that remote control uses the RDP engine in SCCM, and it is new and improved as a result. Therefore, am I correct that as a result, remote control is no longer the security risk it was in SMS 2003?

Forums: Re: SMS2003 to SCCM 2007 SP1 Upgrade = broken MPs

Mon, 09 Nov 2009 18:28:46 GMT

I did not change either name, just blocked them out of the logs.

Blog: Enable Certificate Web Enrollment without SSL(HTTPS) in Windows 2008

Mon, 09 Nov 2009 04:35:18 GMT

Windows 2008 introduces a couple of annoyances with the Certificate Web Enrollment form (/certsrv) that are worth mentioning, and pointing out the workarounds in case you need them. There is a third annoyance (also with a workaround), that is a somewhat more lengthy discussion and will be addressed on it's own.

Problem #1:

The first is the deprecation of the components we use for Web Enrollment. If we look at KB922706, we can see the details of what happened. This KB article is titled:

How to use Certificate Services Web enrollment pages together with Windows Vista or Windows Server 2008

"The Windows Server 2003 Certificate Services Web enrollment functionality relies on an ActiveX control that is named Xenroll. This ActiveX control is available in Microsoft Windows 2000 and in later versions of Windows. However, Xenroll has been deprecated in Windows Vista and in Windows Server 2008".

In short, the components are not present in Windows 2008 by default, but can be downloaded from this KB and implemented if you need them.

Problem #2:

The second is the fact the SSL (HTTPS) is required in order to use the Certificate Web Enrollment form in Windows 2008. When you attempt to access the forum with HTTP://, you receive the following error at the top of your browser:

"Internet Explorer has blocked this site from using an ActiveX control in an unsafe manner. As a result, this page might not display correctly"

It's true that SSL is more secure and definitely a best practice, but especially in lab testing and intranet environments, SSL may not be considered strictly necessary. You can work around this issue.

1. In IE Internet Options, Security Tab, make sure the Certificate Web Enrollment site is in the list of Trusted Sites.

2. With Trusted Sites highlighted, click the Customize Button.

3. In the Security Settings, set "Initialize and script ActiveX controls not marked as safe for scripting" to ENABLED, as shown in the image below.

Conclusion

As always, take care in choosing when it's appropriate to lower your defenses in this area. But when the situations fits, these are some of the tools and methods at your avail to make your work easier.

Forums: Re: SMS2003 to SCCM 2007 SP1 Upgrade = broken MPs

Sat, 07 Nov 2009 10:58:10 GMT

Hi

If referred the comments in the logs. Do you mean you hve changed the server name and SQl server name of your physical boxes ?

Forums: Re: SCCM questions

Sat, 07 Nov 2009 10:30:39 GMT

- A .Net version higher than 2.0 is OK.

- Device Management only supports windows mobile phones. If you want to add support for other devices you need to look at 3rd. party tools.

- What exactly do you mean by a security risk in regards to RDP. ConfigMgr. Utilizes the built-in feature already on the clients (Remote assistance and RDP)

Blog: Part 4: Creating DCM packs with SCCM 2007

Sat, 07 Nov 2009 14:55:25 GMT

There maybe a reason why you need some code from an existing Configuration Item but each item has a lock on it to stop you from editing the configuration.

Here is a more close up view of the ‘Golden Padlock’

And as you can see everything is greyed out! Why is it like Operations Manager where you can seal a Management Pack? NO, it is not if you write a DCM within in a SCCM environment it will remain open no padlock all is changeable) as soon as you import it into another SCCM server it will lock automatically. There is is code generated with the XML that controls this.

So how can we get around this? Hey that’s the easy part right click on the locked Configuration Item and click ‘Duplicate’

Save with a name to suite you, or leave with the ‘[1]’ the wizard adds

Now you now have an unlocked Configuration Item

See the padlock has been removed

And all properties are now changeable

I hope this 4 part series will help you in getting started with DCM pack creation. Also if I can help you achieve this then message me on simon at skinner.fr.

Here is the other 3 parts to this series listed;

http://www.systemcentercentral.com/BlogDetails/tabid/143/IndexId/46753/Default.aspx

http://www.systemcentercentral.com/BlogDetails/tabid/143/IndexId/48787/Default.aspx

http://www.systemcentercentral.com/BlogDetails/tabid/143/IndexId/49396/Default.aspx

Forums: Re: SCCM questions

Sat, 07 Nov 2009 09:02:26 GMT

NAP:- All Windows NAP enforcement solutions require Windows Server 2008.

NAP-capable clients (such as Windows Vista, Windows Server 2008, or computers running Windows XP Service Pack 3).

You can find more information on http://technet.microsoft.com/en-us/library/bb681008.aspx

.net 2.0 :- I suggest go with the prerequistes metioned in the technet doc and not to assume on that until and unless you'r installing 1 more application on the sccm server and that application require latest verion of .net.

The .NET Framework version 2.0 improves scalability and performance of applications with improved caching, application deployment and updating with ClickOnce, support for the broadest array of browsers and devices with ASP.NET 2.0 controls and services.

Forums: SCCM questions

Sat, 07 Nov 2009 00:10:18 GMT

We are getting ready to upgrade to SCCM from sms 2003. My research has generated a number of questions that run the gamut. I will try to limit them to a few at a time. Here goes and thank you!

Re: the .net 2.0 requirement. Am I correct in assuming that a higher version of .net is OK, or does it have to have 2.0 along with whatever other versions are installed?

Re: NAP and system health validation. Are these the only new features that require Server 2008, or is there something else?

I don't know when Server 2008 will be implemented in our environment, so can we implement NAP and system health validation at a later date? I was told that you can utilize different servers for different functions in the SCCM infrastructure, but does the central site server need to be on 2008 to take advantage of this functionality?

Re: device management. Does this only manage windows mobile devices, or do you need windows mobile installed in the admin console or anything like that to manage devices? In other words, if you just have blackberry devices, can device management manage them, or do you need windows mobile in your environment?

Remote Control vs. Remote Assistance: I was told that this runs on RDP in SCCM. Is remote control still a security risk in SCCM?

Forums: Re: ONE client generating multiple DDR errors - help!

Fri, 06 Nov 2009 23:57:17 GMT

The machine has been off and on the network so it is hit and miss. I finally had a chance to do a comprehensive manual rebuild of the wmi. That didn't work, so I tried it again AND uninstalled the client and and and and. The machine is once again off the network, so I'm not sure of the results, but if you would like to specify which logs you are talking about I will see what I can do. While this one has been off the network, it has been on pretty regularly as well. thanks. : )

Forums: SMS2003 to SCCM 2007 SP1 Upgrade = broken MPs

Fri, 06 Nov 2009 18:17:44 GMT

This weekend I finally upgraded my central site from SMS 2003 to SCCM 2007 Sp1, I had no issues with the central site upgrade. When we moved on to the Secondaries we noticed some issues. On the Secondaries the DP works fine but I am getting the following error in mp_setup.log and a couple of the other mp logs have similiar errors. I have ripped off the MP and reinstalled, I have ripped of the client and reinstalled and I have even removed IIS,BITS, MP and the Client. The error continues to come back. I have logged a call with MS but we are not getting very far basically everything listed above. We did recently change our server from a domain SQL account to local system so we made some changes to the SPN. No luck.... Any ideas?

paste from mp_policy.log:

CMPDBConnection::ExecuteSQL(): ICommandText::Execute() failed with 0x80004005 MP_PolicyManager 11/6/2009 11:47:19 AM 3012 (0x0BC4)

======================================= MP_PolicyManager 11/6/2009 11:47:19 AM 3012 (0x0BC4)

MPDB ERROR - CONNECTION PARAMETERS

SQL Server Name : XXXXXXXX(I change the server name)

SQL Database Name : XXX_XXX(I also change this)

Integrated Auth : True

MPDB ERROR - EXTENDED INFORMATION

MPDB Method : ExecuteSP()

MPDB Method HRESULT : 0x80004005

Error Description : [DBNETLIB][ConnectionRead (recv()).]General network error. Check your network documentation.

OLEDB IID : {0C733A63-2A1C-11CE-ADE5-00AA0044773D}

ProgID : Microsoft OLE DB Provider for SQL Server

MPDB ERROR - INFORMATION FROM DRIVER

Native Error no. : 11

Error State : 1

Class (Severity) : 16

MP_PolicyManager 11/6/2009 11:47:19 AM 3012 (0x0BC4)

=======================================

MP_PolicyManager 11/6/2009 11:47:19 AM 3012 (0x0BC4)

CPolicyManagerHandler::HandleMessage(): SetComplete(DISCARD) called. MP_PolicyManager 11/6/2009 11:47:19 AM 3012 (0x0BC4)

Forums: RE: ONE client generating multiple DDR errors - help!

Fri, 06 Nov 2009 14:06:49 GMT

would it be possible to zip the log files and post them? I may be able to look through them and see if I can help point you in the right direction.

question:

is this mixed or native mode?

I ran into an issue like this before and oddly enough it was a computer account that had not logged in for about six months. Unjoining and rejoining it to the domain resolved my issue.

Forums: RE: Remote client not receiving package

Fri, 06 Nov 2009 13:40:06 GMT

I figured it out. It had to do with BITS. It was turned on under the dp settings. I turend it off and it worked like a champ.

Blog: Part 3: Creating DCM packs with SCCM 2007

Thu, 05 Nov 2009 20:59:50 GMT

In part 2 we created a new DCM Pack. Here in part 3 I would wanted to cover a particular aspect in the saving process, version can be a problem when saving your DCM so here are the steps to get around this problem, go to your DCM in the SCCM Console

Right click to export the DCM, which is just a cab file

save to your desktop

When saved it will look like this

Right click on the Cab file

Open then extract the XML. Note the 6 files!!

When extracted we can start to modify, also delete the RESX files we do not need these.

You can use Notepad but if you have a lot of files I use Visual Studio

Here are is the raw XML code, we are only interested in the Build Version

As we entered no info the Build Info shows just Zero’s

Modify to the the Version you want and remove ServicePackMajorVersion and ServicePackMinorVersion entries so it looks like line below

You could just use the Find and Replace in Visual Studio to do this

These next steps are optional if you wish to make it posh like for a client, as the files where saved with number you could find the ‘Display Name’ and save as this name as I have below. This makes the XML a little neater.

When the above steps are completed we need to re package the XML back into a Cab file, I use ‘Cab File Maker’ it’s simple and easy to use. Just drag and drop the 3 XML files into the Cab File Maker name the files and click start

Then when you have a re packaged Cab file import back into the SCCM Console

Then away you go with your DCM. I have to be careful of an NDA I have but I will say this, really BIG companies do it like this!

Forums: Remote client not receiving package

Thu, 05 Nov 2009 14:32:06 GMT

All,

I have 1 sccm MP server with several distibution points that are protected. I have my office 2007 package on all distrbution points.

I am testing a client at one remote office (using its protected distribution point) to install office.

If I look at C:\windows\system32\ccm\cache I see the package folder ABC0001D.4 but I do not see any contents in that folder. I look at my advertisement log and the last thing is see is a message id 10035 which says its downloading it.

This package is about 900 mb and has been 30 minutes and still nothing in that folder.

I tried looking at the CSA.log on the system in question and I see:

Download location found 2 - \\servername\sharename\SMSPKG\abc0001D\

and

Download request only, ignoring location update

Am I missing something? is there another log I can look at?

Thanks,

Tom

Forums: RE: Error 11756!?

Wed, 04 Nov 2009 18:10:02 GMT

Try this link.

http://social.technet.microsoft.com/Forums/en/configmgrsum/thread/8759ff20-a1c3-4932-a786-0cd2dff9f8da

Blog: TechEd Berlin: Using Microsoft System Center to Manage Beyond the Trusted Domain

Wed, 04 Nov 2009 21:22:03 GMT

Rory McCaw and myself will be in Berlin at TechEd next week and hope to see you there!

We will be co-presenting in a level 300 breakout session on Monday, November 9th titled "Using System Center to Manage Beyond the Trusted Domain". We'll be discussing how to leverage PKI in Windows 2008 R2 to extend the reach of System Center to systems outside the Active Directory trust boundary. I've included a preview agenda below. We hope to see you there!

Preview Agenda

Windows 2008 PKI Drill Down
Using PKI to Extend the Reach of System Center
Changes in Provisioning Certificates in Windows 2008
Bulk Certificate Provisioning for System Center
Managing Internet-Based Clients with ConfigMgr 2007
Troubleshooting Certificate Issues
Monitoring CA and Certificate Validity

Blog: Part 2: Creating DCM packs with SCCM 2007

Wed, 04 Nov 2009 17:09:20 GMT

After Part 1 really just an intro in DCM we look at creating a new DCM Pack with Scripts, this is a long document and there are a few steps. So navigate to Desired Configuration Management (DCM) with in the SCCM Console.

Right click on Configuration Items, click new and in this case I have selected Operating System Configuration Item, if you want to chose another you can.

With the wizard open enter a name and description.

I want you to pay attention to this screen, this is a place where things can go wrong. I will go into detail in Part 3 which will follow soon why we leave this as is seen. I will detail how we edit this in XML so we can remove some of the fields making it a better to detect different versions.

The Objects section is not required for script but we will address it function in Part 4

In the setting section is where we are going to make it all happen with our script so click on “New”

When you click on New select “Script”

This will open this window, note it asks which script language. Our script today is VBScript so I have it selected on VBScript

Enter a name, description and your script, just cut a paste. Make sure your script has been tested as a VBScript before using it.

Here is another very important part, do we know what we are looking for as a response, well Read Only SNMP Community String have a DWORD setting of 4 in the registry.

So we are looking for the value of 4, if we where to change this to ‘Does not Match’ 4 then we could set the severity to Warning

Click OK, the Validation will look like this.

Click OK,

And again

Last time

And now are on the on the way to create the DCM but still have some more steps

Rick click on the newly create Item and select ‘Create child configuration Item’

This trys to add the date and time remove those

So it looks like this

Now you have 2 Items, the child needs no extra work and will always be a replica of the Parent and is used for the deployment of the XML

Now lets go to the Configuration Baseline and right click ‘New Configuration Baseline’

In the wizard give it a name (this is going to be the name of the DCM Pack)

Click next

And again

Click next

So you get a Configuration Baseline

Then right click on it select ‘Add’ the ‘Operation System Configuration Item’

You will get loads of item show up here is you have already imported DCM so you can use the ‘Look for’ as I have to narrow down the search, click on the two items (child as well)

So than when you look in the Rules it shows you the added rules

Click OK. Less the OS version we are ready to go.

I will follow up with the Part two this week which is also a heavy going document.

Blog: Powershell: OpsMgr Alert-to-Speech (cool idea from Gary Broadwater at Quest)

Wed, 04 Nov 2009 09:48:32 GMT

A customer request had me looking around the support community of one of our community sponsors - Quest. (The site is management-extensions.org). While I was there, I ran across something that raises some interesting possibilities for audible alarms using the OpsMgr Command Notification Channel. This would be especially with remoting in Powershell 2.0 so we could execute the audible alarm on a system that is NOT the RMS.

Gary Broadwater (eXc-turned-Quest architect) posted the most simple Powershell snippet HERE.

If you save this as a text_to_speech.ps1 file and pass a text string to it, your computer will recite the words. Text-to-speech in 3 lines. They don't call it Powershell for nothing.

################################
# Company: Quest Software
# Author: Gary Broadwater
################################

$q = new-object -com SAPI.SpVoice
$q.speak($args)
$q = $null

Sample Run

I ran exactly this on my computer, and I could make the words out very clearly!

.\text_to_speech.ps1 Quest extends system center to the non-windows world!

Calling the script remotely from the RMS

Then, from your OpsMgr RMS, you could use the notification command channel to call the remote script. I have Powershell 2.0 running on an OpsMgr lab server, so I would expect this should be okay, but you'd want to test carefully I think. I don't think I'd do this without Powershell 2.0, because you need it for remoting to avoid running this on the RMS. Here's PoSh 2.0 syntax to do it.

invoke-command -computername RemoteAlertComputer -filepath c:\Scripts\text_to_speech.ps1

NOTE: You could work out how to pass the OpsMgr alert description with the standard XPath as a script argument, but I think this would work best with a short message hard-coded in the script.

And a Personal Comment on Quest

I have talked with the technical folks at Quest about what they're doing with PRO and virtualization, application virtualization, extending Configuration Manager to support non-Windows systems, and they are working on some pretty cool answers for difficult technology and business problems. I have to say I am genuinely excited to see what develops. And I want to add this personal note about the tech support I've received from these guys. In short, the best of any ISV I have worked with. Gary, Tony and gang have delivered for me whenever I needed an assist.

Take a look at the ways Quest extends System Center at http://www.quest.com/system-center/

Visit the Quest Heterogeniuses Blog

Blog: The Springboard Series Community Partei @ Microsoft TechEd Berlin

Wed, 04 Nov 2009 03:53:39 GMT

Cool party announced for TechEd Europe on the TechNet Plus Blog.

If you plan to attend Microsoft TechEd in Berlin, join us for a special celebration!

Party Details and Registration URL

On Tuesday, 10 November, at 21:00, get ready to rub shoulders with some of the world’s most powerful IT Professionals and community influencers.
Exclusively for Springboard Series Technical Expert Panelists (STEP), Microsoft MVPs, TechNet Plus Subscribers, and Microsoft Certified Trainers (MCTs), the Springboard Series Community Partei held the week of TechEd Europe in Berlin, Germany, is your opportunity to network with industry peers and key Microsoft executives, learn about other communities and special offerings, and enjoy an evening full of music (DJ’d by our very own Joey Snow and David Lowe), food, drinks, and fun—all compliments of Microsoft.
Party attendance is limited, so be sure to register today to reserve your spot at TechEd Europe’s only community party!

Brought to you by Springboard Series, TechNet+ Subscriptions and Microsoft Server

Registration Site: https://microsoft.crgevents.com/CommunityPartei/

Registration Code: TE-TN