SCUG.dk

Shavlik now integrates with ConfigMgr. Software Updates

Kent Agerlund — Thu, 04 Mar 2010 19:34:13 GMT

Most of you already have knowledge about the power of SCUP used together with ConfigMgr. System Center Custom Updates (SCUP) gives you the possibilities to include 3rd. party updates in your normal Configuration Manager software update deployments. One of the downsizes to SCUP is that it requires high level of knowledge about each update you want to distribute.

Shavlik now offers ConfigMgr. Customers to subscribe to a very rich catalog of 3rd. party updates. Read more about the solution http://www.shavlik.com/scupdates.aspx and to see full list of updates supported - http://forum.shavlik.com/viewtopic.php?f=67&t=15901

New Configuration Manager guides are ready for download

Kent Agerlund — Thu, 04 Mar 2010 08:26:54 GMT

Microsoft has released a couple of new guides ready for download. I have read the guides and they are really great. They can (and must) be used in every single Configuration Manager Deployment project. They will walk you through some design considerations as well as providing useful information about the features and provide you with best practices. Happy reading :-) it’s only about 400 pages in total.

The guides can be downloaded from:

System Center Configuration Manager 2007 Deployment Guide

System Center Configuration Manager 2007 Software Distribution Guide

System Center Configuration Manager Software Update Management Guide

System Center Configuration Manager 2007 Operating System Deployment Guide

Hide and Show software update notifications

Kent Agerlund — Fri, 19 Feb 2010 10:33:20 GMT

As you might now; most agent settings are configured for the entire site. However with a little reading in the Configuration Manager SDK you will quickly learn how to customize agent setting on individual clients. One of the challenges that I run into the most; is hiding software update notifications from some clients while allowing a full notification on other computers.

You can solve this challenge in two different ways.

Hide all software update deployments and create a package that will display notifications on some clients
Allow software update notifications and create a package that will remove the notification on some clients.

Configure the Software Update Client Agent

In this example I will allow all notifications and create a package that will remove the notification icon on computers in a specific collection.

The package

The script to be used in the package can be downloaded from the ConfigMgr. SDK. You only need to modify the script to match your scenario. In my example I have configured the UserExperienceFlag to 2 which will remove any notifications.

To create the package

Copy the code below and save it as a VBS file.
Create a new package with the VBS file
Run the package under the local system account and without any user interaction on computers where you DON’T want any user notifications.

' //***************************************************************************
' // ***** Script Header *****
' //
' // Solution:  Config Mgr
' // File:      HideNotifications.vbs
' // Author:    Configuration Manager 2007 SDK, modified by Kent Agerlund
' // Purpose:   Remove software update notifications from the notification area
' // Values:    SetUserExperienceFlag| 0=Use Policy, 1=Always display notifications    
' // Values:    SetUserExperienceFlag| 2=Never display notifications    
' //
' // ***** End Header *****
' //***************************************************************************
'//----------------------------------------------------------------------------
'//
'//  Global constant and variable declarations
'//
'//----------------------------------------------------------------------------

dim updatesDeployment
    
set updatesDeployment = CreateObject ("UDA.CCMUpdatesDeployment")
updatesDeployment.SetUserExperienceFlag 2

Configure the Software update deployments

Make sure you configure a deployment deadline for those computers that don’t display software update notifications otherwise updates will never be installed.

You can download the ConfigMgr 2007 SDK from http://www.microsoft.com/downloads/details.aspx?familyid=064a995f-ef13-4200-81ad-e3af6218edcc&displaylang=en

UPDATED: BitLocker Recovery Password Viewer and Windows Server 2008 or Vista SP2

Jens Ole Kragh — Tue, 16 Feb 2010 20:52:36 GMT

Lately I have been working at a deployment project where the customer wanted to enable BitLocker Drive Encryption at all computers with a TPM chip. Doing that is not that big a problem. As always I extended the Active Directory Schema so the clients were able to store the BitLocker Recovery Password in Active Directory.

I’m always using this guide from Microsoft
http://www.microsoft.com/downloads/details.aspx?familyid=3A207915-DFC3-4579-90CD-86AC666F61D4&displaylang=en

1. Extend AD Schema “ldifde -i -v -f BitLockerTPMSchemaExtension.ldf -c "DC=X" "DC=nttest,dc=microsoft,dc=com" -k -j .”

2. Set required permissions using “cscript Add-TPMSelfWriteACE.vbs”

3. Create and link a GPO to the computers OU, setting this:
“Turn on BitLocker backup to Active Directory” = Enabled (Verify that the Require BitLocker backup to AD DS check box is selected)
”Turn on TPM backup to Active Directory” = Enabled (Verify that the Require TPM backup to AD DS check box is selected)

4. Verifying the configurations made using the described tools and procedures in the document

5. Install BitLocker Recovery Password Viewer for Active Directory Users and Computers and register the dll file.
http://www.microsoft.com/downloads/details.aspx?FamilyID=2786fde9-5986-4ed6-8fe4-f88e2492a5bd&displaylang=en&Hash=mOWNFADTKH1Wp6mdULeEN2TfWfnzZjY8JPVp%2fzJwwJ4%2bX1GUBBWaX96E%2fXO%2bM1QeYxbbQFYjYxX1nKcvREB0sA%3d%3d

But I had a problem! I could NOT install the Viewer, it’s NOT supported at Windows Server 2008 Service Pack 2 or Windows Vista Service PAck 2, only Service Pack 1 systems. So creating this new environment using Windows Server 2008 SP2 and Vista SP2 left me with only one option – Install a Windows Vista SP1 (easiest, for me!)

So if you want to view the Recovery keys from a Graphical User Interface you will have to Install either a server running Windows Server 2008 SP1 or a client running Windows Vista SP1 with RSAT tools installed.

I will update this article, when the BitLocker Recovery Password Viewer is supported in a Service Pack 2 environment.

Notices:
When client store the Recovery Password in Active Directory the information send is protected by using kerberos and the keys in Active Directory are protected by ACL’s.
How to use the BitLocker Recovery Password Viewer
http://support.microsoft.com/default.aspx/kb/928202

************UPDATE**************

Microsoft has just released KB928202 – Bitlocker Recovery Password Viewer for Windows Server 2008 Service Pack 2 and Windows Vista Service pack 2
http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=16088271-f95d-4c5c-9ea9-03746c96ffff

Tripple check your software updates this month

Kent Agerlund — Mon, 15 Feb 2010 07:23:03 GMT

As some of you might already be aware of; MS10-015 (KB977165) might cause a BSOD. As far as I have read the problem is not the update itself, but caused by an existing infection on the computer. For updates on this issue be sure to check - http://blogs.technet.com/msrc/archive/2010/02/11/restart-issues-after-installing-ms10-015.aspx

Problem finding the Win7 Time Zone names!

Michael Petersen — Fri, 12 Feb 2010 08:26:18 GMT

Remember In the good old Windows XP days, when the Time Zone you used when creating your Sysprep.inf/Unattend.txt was just a number you could look up in a Microsoft table (and properly also remember)

Well those days are almost gone and now you will have to use Time Zone ID which is a Name rather than a number, so the Danish time zone that used to be 105, is now Romance Standard Time…

So the question then is, where do i get a hold of those names?? The answer is simple…TZUTIL which is an embedded windows 7 command line tool.

Just run TZUTIL /l from a prompt in Win7 and you will get at a full list

Monitor the size on your inventory data

Kent Agerlund — Tue, 09 Feb 2010 16:55:29 GMT

As you might know SMS/Configmgr; has some secret files that can change the way agents behave. One of the files is called archive_reports.sms. When you add this file to the inventory temp folder (\system32\ccm\inventory\temp\) it will prevent the inventory xml files from being deleted after they are send to the management point. This can be very useful when you want to track the size of each inventory file. In my screen dump you can see several xml file. I use this feature to spot the change in file size whenever I enable new classes in my sms_def.mof file (AI classes, custom classes etc).

As you can see from the pictures it’s easy to check the size of each file and also to read the information – very useful. Just remember to delete the archive_reports.sms file when you are done testing.

The file has been around for many years, and I am pretty sure you will find the information on other blogs as well.

The annoyance of none elevated command prompts.

Michael Petersen — Tue, 09 Feb 2010 08:11:06 GMT

You know how when ever you run something from a prompt in Windows 7 or Server2008 you need to remember to elevate the privileges, or you will get the annoying message that you do not have administrative privileges, which then means you will have to open a new prompt, run it as administrator, and do things all over again.. (especially annoying when working with WAIK)

Well I know that you could just disable UAC all together, but that's not what Microsoft intended when they put it there! and it would also mean a huge decrease in security.

So what to do about that! Well the simple solution is an old one that everyone knows, but like me might have forgotten.

	first open the shortcut to the app in question. In this case it is the Deployment Tools Command Prompt used when working with ImageX, DISM and other WAIK tools. Hit the Advanced button.
	Make sure Run as administrator is checked, and click OK twice to accept the change. That's is! Not very hardcore technical stuff, but none the less, it saves me a lot of headache..

IBM Deployment Pack v1.2 for ConfigMgr released

Ronni Pedersen — Mon, 08 Feb 2010 22:12:20 GMT

The IBM Deployment Pack for Microsoft System Center Configuration Manager 2007 (SCCM) is used to configure IBM hardware components prior to deploying Windows using Microsoft SCCM. This kit extends Configuration Manager 2007 by providing a convenient integrated user interface that will be familiar to SCCM administrators. The Deployment Pack completes the end-to-end deployment scenario in environments where IBM-specific configuration steps are required including RAID, IMM, RSA2, BMC, and BIOS/UEFI.

Key features include:

IBM-specific drivers, agents, and firmware
Scriptable hardware configuration tools for the Windows Preinstallation Environment (WinPE)
Sample configuration files and scripts, including sample Sysprep and Unatted.txt files

Download here.

Our Hero!

Ronni Pedersen — Sat, 06 Feb 2010 14:50:40 GMT

As a follow up on the great success it was when we had our first SCUG “offline” meeting, we’re proud to present OUR HERO!

http://en.tackfilm.se/?id=1265410581898RA45

It might take a while to load, but it’s well worth watching…

Distribution Manager – NAL error

Kent Agerlund — Fri, 29 Jan 2010 16:39:59 GMT

Its Friday the weekend is coming up and what I don’t want is a day filled errors . On the other hand, errors can be a cool way to start the weekend – if you get them solved! The first 10 minutes at the customer site went according to my plan. I got some coffee and began to distribute a new package. The coffee was black and strong (which is good) but my package never made it to the distribution point (which is not good).

The error

The status in the console was stuck in Install Pending. I looked at the distmgr.log file on the site server and saw these entries:

RDC:This is a Share Type DP. Will use the Share Name smssoftware$ for RDC signature    SMS_DISTRIBUTION_MANAGER    29-01-2010 12:56:47    5308 (0x14BC)
Cannot create NAL path for the distribution point ["Display=\\sccmDP\smssoftware$\"]MSWNET:["SMS_SITE=DK1"]\\sccmDP\smssoftware$\    SMS_DISTRIBUTION_MANAGER    29-01-2010 12:56:47    5308 (0x14BC)
STATMSG: ID=2323 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER" SYS=sccmDP SITE=DK1 PID=7992 TID=5308 GMTDATE=Fri Jan 29 11:56:47.052 2010 ISTR0="" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=2 AID0=400 AVAL0="NS100027" AID1=404 AVAL1="["Display=\\sccmDP\smssoftware$\"]MSWNET:["SMS_SITE=Dk1"]\\sccmDP\smssoftware$\"    SMS_DISTRIBUTION_MANAGER    29-01-2010 12:56:47    5308 (0x14BC)
Error occurred.    SMS_DISTRIBUTION_MANAGER    29-01-2010 12:56:47    5308 (0x14BC)

Notice the NAL path error. I have seen this error many times before but always related to missing permissions on the distribution point.

Investigating the error

For a brief moment I thought about reapplying ConfigMgr. SP2 but somehow that always seems to be an act of desperation. In stead I enabled NAL logging and started to dig deeper into the distmgr.log file.

NAL logging

NAL logging is enabled in registry on the site server. For more information about NAL logging check http://support.microsoft.com/kb/243385/

Navigate to HKLM\Software\Microsoft\NAL
Create a new Key called Logging
Create two new DWORD values log To with a value of 3 (decimal) and Verbosity with a value of 7 (decimal). The value 7 will give you warnings, errors and information messages.
Once NAL logging is enabled I went back into the distmgr.log file (along with a fresh cup of coffee).

What the distmgr.log file revealed

With NAL logging enabled I refreshed the distribution point for one of my packages and saw these new entries:

Attempting to add or update a package on a distribution point.    SMS_DISTRIBUTION_MANAGER    29-01-2010 13:31:51    4256 (0x10A0)
for ["Display=\\sccmDP\smssoftware$\"]MSWNET:["SMS_SITE=DK1"]\\sccmDP\smssoftware$\, no connection account is available    SMS_DISTRIBUTION_MANAGER    29-01-2010 13:31:51    4256 (0x10A0)
STATMSG: ID=2342 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER" SYS=sccmDP SITE=DK1 PID=7964 TID=4256 GMTDATE=Fri Jan 29 12:31:51.601 2010 ISTR0="Acrobat Reader" ISTR1="["Display=\\sccmDP\smssoftware$\"]MSWNET:["SMS_SITE=DK1"]\\sccmDP\smssoftware$\" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=2 AID0=400 AVAL0="NS100027" AID1=404 AVAL1="["Display=\\sccmDP\smssoftware$\"]MSWNET:["SMS_SITE=DK1"]\\sccmDP\smssoftware$\"    SMS_DISTRIBUTION_MANAGER    29-01-2010 13:31:51    4256 (0x10A0)
RDC:This is a Share Type DP. Will use the Share Name smssoftware$ for RDC signature    SMS_DISTRIBUTION_MANAGER    29-01-2010 13:31:51    4256 (0x10A0)
NAL[4] - Call to the Abnetwork DLL's DllGetClassObject function succeeded.    SMS_DISTRIBUTION_MANAGER    29-01-2010 13:31:51    4256 (0x10A0)
NAL[2] - Provider list is already initialized.    SMS_DISTRIBUTION_MANAGER    29-01-2010 13:31:51    4256 (0x10A0)
NAL[4] - Attempting to create path for MSWNET:["SMS_SITE=DK1"]\\sccmDP\smssoftware$\.    SMS_DISTRIBUTION_MANAGER    29-01-2010 13:31:51    4256 (0x10A0)
NAL[2] - CreatePath, wrong provider: ABEXPRT. Trying next provider...    SMS_DISTRIBUTION_MANAGER    29-01-2010 13:31:51    4256 (0x10A0)
NAL[2] - CreatePath, wrong provider: LOCAL. Trying next provider...    SMS_DISTRIBUTION_MANAGER    29-01-2010 13:31:51    4256 (0x10A0)
NAL[1] - ERROR: could not create the path.    SMS_DISTRIBUTION_MANAGER    29-01-2010 13:31:51    4256 (0x10A0)

That’s the error, the distribution manager component is trying to create the folder using a wrong provider.

The solution

Now when I knew what was causing the error I could start fixing it. The NAL providers are stored in Registry and all 4 providers (LOCAL, MSWNET, NWNDS, NWBIND) was found the HKLM\Software\Microsoft\NAL\Providers\Active Orders key. I did discover that the HKLM\Software\Microsoft\NAL\Server\Connections\Operational Active Order was missing an important value.

As you can see the only provider listed is Local. I added MSWNET to the list and restart the SMS_executive service.

I refreshed one of my packages while reading distmgr.log (with trace32.exe). As you can see in the log the problem is now fixed and I can start my weekend with a smile on my face :-)

NAL[2] - Provider list is already initialized.    SMS_DISTRIBUTION_MANAGER    29-01-2010 13:50:50    2516 (0x09D4)
NAL[4] - Attempting to create path for MSWNET:["SMS_SITE=DK1"]\\sccmDP\smssoftware$\.    SMS_DISTRIBUTION_MANAGER    29-01-2010 13:50:50    2516 (0x09D4)
NAL[2] - CreatePath, wrong provider: ABEXPRT. Trying next provider...    SMS_DISTRIBUTION_MANAGER    29-01-2010 13:50:50    2516 (0x09D4)
NAL[2] - CreatePath, wrong provider: LOCAL. Trying next provider...    SMS_DISTRIBUTION_MANAGER    29-01-2010 13:50:50    2516 (0x09D4)
NAL[4] - CreatePath, MSWNET is the correct provider.    SMS_DISTRIBUTION_MANAGER    29-01-2010 13:50:50    2516 (0x09D4)
NAL[4] - Provider MSWNET successfully got objects for path MSWNET:["SMS_SITE=DK1"]\\sccmDP\smssoftware$\.    SMS_DISTRIBUTION_MANAGER    29-01-2010 13:50:50    2516 (0x09D4)
NAL[4] - Successfully created the path: MSWNET:["SMS_SITE=DK1"]\\sccmDP\smssoftware$\.    SMS_DISTRIBUTION_MANAGER    29-01-2010 13:50:50    2516 (0x09D4)

SMS 2003 support for Windows 7 and Windows Server 2008 R2 clients

Ronni Pedersen — Wed, 27 Jan 2010 22:02:41 GMT

Microsoft has released a new compatibility pack for SMS 2003 SP3 that’s adds Windows 7 and Windows Server 2008 R2 as supported clients. However since main stream support for SMS 2003 has already ended I would highly recommend that you start migrating to Configuration Manager 2007 SP2 ASAP, and only use this update as a "workaround" until you everything migrated.

More info and download:
http://support.microsoft.com/kb/974014

Enjoy.

Software Updates – Waiting for another installation to complete

Kent Agerlund — Fri, 15 Jan 2010 17:11:42 GMT

Looking at the compliance reports I see that most of updates are installing ok but some are constantly saying “Waiting for another installation to complete”

The updates won’t install and end-users are constantly getting an error saying the another installation process is already running. It’s not another running process causing the problem, so restarting services won’t help. Information is stored in WMI and most likely is caused by an earlier installation that failed.

To fix the problem

Log on to the client and stop the Windows Management Instrumentation Service – WMI
Rename the Repository folder to RepositoryOLD. The folder is found in %systemroot%\system32\WBEM
Restart the Windows Management Instrumentation Service. This will create a new Repository folder and the software update installation will be able to start.

WEBdav fails on Windows server 2008 R2

Kent Agerlund — Wed, 30 Dec 2009 09:16:25 GMT

Just spend a few hours this morning troubleshooting a new Configuration Manager 2007 SP2 R2 installation. After configuring the Management Point I started to receive these errors:

Sitecomp.log:

Component [SMS_MP_CONTROL_MANAGER] could not install correctly on server Servername. WebDAV on the Windows Longhorn server is not configured correctly.

MPsetup.log

<12-30-2009 09:00:07> WebDAV settings is not setup appropriately
<12-30-2009 09:00:07> [Allow property queries with infinite depth] should be true (true)
<12-30-2009 09:00:07> [Allow Custom Properties] should be false (false)
<12-30-2009 09:00:07> [Allow anonymous property queries] should be true (false)
<12-30-2009 09:00:07> Allow [All users read access to All content] authoring rule should exist (exist)

The problem with the log files is, that they are not telling the truth. I did already install and configure the WEBdav component as I have done several times before.

Reason behind the problem

For some reason the WEBDAV_schema.xml files is not being updated by the changes in the IIS console (the file is found in C:\Windows\System32\inetsrv\config\schema\)

The solution

Stop the IIS service
Take ownership of the file
Assign your own account the correct permissions required to modify the file
Remove the Read only attribute on the file
Open the file, find these lines and change whatever values they have to the ones listed below.

<attribute name="allowAnonymousPropfind" type="bool" defaultValue="true" />
<attribute name="allowInfinitePropfindDepth" type="bool" defaultValue="true" />
<attribute name="allowCustomProperties" type="bool" defaultValue="false" />
Start the IIS service
Restart the SMS Site Component Service
Check the MPsetup.log file and verified everything was OK
Open a browser and type http://localhost/SMS_MP/.sms_aut?MPLIST The result of this must NOT be an error. Run the check from the MP server or replace localhost with the MP name.

MPsetup.log after editing the xml file

Disable Adobe Reader JavaScript

Kent Agerlund — Fri, 18 Dec 2009 12:47:18 GMT

Adobe has just informed about a critical vulnerability in Adobe Reader 9.2 and earlier versions - which is well… all Adobe Reader versions :-) An update to fix the vulnerability will be released mid January 2010.

You can read the bulletin here - http://www.adobe.com/support/security/advisories/apsa09-07.html

Disable Adobe Reader JavaScript manually

1. Launch Adobe Reader.
2. Select Edit>Preferences
3. Select the JavaScript Category
4. Uncheck the 'Enable Acrobat JavaScript' option
5. Click OK

Disable Adobe Reader JavaScript with a configmgr. package

1. Create bat file with this entry
reg add "HKCU\Software\Adobe\Acrobat Reader\9.0\JSPrefs" /v bEnableJS /d 0 /t REG_DWORD /F
2. Copy the bat file to a network share and create a new package in ConfigMgr.
3. Create a new program and make sure it Runs with user’s rights and only when a user i logged on.

MMS 2010 registration now open

Kent Agerlund — Thu, 10 Dec 2009 07:10:51 GMT

As always a huge delegation of Danes will invade Las Vegas in late April. 2010 wont be any different, SCUG DK will be there and hope to see all of you. For registration and more information check the MMS 2010 site - http://www.mms-2010.com/public/home.aspx

New and updated version of SCUP 4.5

Kent Agerlund — Tue, 24 Nov 2009 20:21:47 GMT

Great news for those of you who uses SCUP 4.5 to create custom updates. An update to SCUP has just been released and is ready for download. With updated version we now have the ability to create and publish msp files to ConfigMgr without crashing the SCUP console – nice :-)

You can download the new version here - http://www.microsoft.com/downloads/details.aspx?FamilyID=0446cce9-94a4-4fb0-b335-e7516044063d&displaylang=en

You can download 3rd. party catalogs here - http://technet.microsoft.com/en-us/configmgr/bb892875.aspx

Capture none syspreped image using SCCM (Running imagex from a TS)

Michael Petersen — Mon, 23 Nov 2009 21:23:34 GMT

One of the limitations of SCCM is the use of Imagex. When you want to capture an image of a computer, this computer needs to be syspreped before capture, or the capture process will fail.

To do a capture of a reference image before sysprep, you normally would have to create a separate WinPE and run ImageX from that. This is also the case if you want to backup a system.

So once again MDT comes to the rescue… By using the ZTIBackup.wsf script, you not only get to run ImageX from a Task Sequence, you also utilize the Append part of ImageX, which lets you add images to already existing images, only adding changes.. By taking advantage of that you can add a new reference image to already existing one, and the size will only increase with the changes.

Another benefit is the speed with witch the image is created. Because all the general Windows files are already captured in the initial image, only the changes will have to be captured..

So how is this done then--

1. You will have to integrate MDT into SCCM

2. (Create Toolkit Package)

3. Create the Task Sequence

	First you must ad a step to use the MDT toolkit package.
	In Toolkit package: Browse and select your MDT toolkit package.
	Now add a step to Set Task Sequence Variable.
	In Task Sequence variable: type in the MDT variable ComputerBackupLocation In Value: Type in the path of the share where you want to place the image.
	Add another Task Sequence variable, to assign a name to the image file Variable: BackupFile Value: The name of the image file, including the .wim extension NOTE: If you leave out this variable, the image file name will will be set to ComputerName.
	Finally add a Run Command Line Step
	In the Command line: type in cscript.exe “%scriptroot\ZTIBackup.wsf”
	That’s it. The Task Sequence should now look like the on to the left. Just advertise, and run it on the computer you want to make an image of. remember it must be run from the Boot image.

SCUG Event on Wednesday – NEW LOCATION and avaiable seats

Kent Agerlund — Mon, 16 Nov 2009 17:02:21 GMT

Great news; we have moved the meeting to a new and bigger auditorium. This means that we still have available seats left. To join us send a mail to event@scug.dk with you Name, Company name and SCUG user name. For more information about the event check - http://scug.dk/content/Events.aspx

Address and location

The address is Teknologisk Institut, main entrance 1, Gregersensvej, 2630 Taastrup

Software installed the last 7 days

Kent Agerlund — Thu, 29 Oct 2009 16:57:51 GMT

This report will list all software registrered in Add/Remove programs and installed during the last 7 days.

The SQL code

SELECT     TOP (100) PERCENT dbo.v_R_System.Name0, dbo.v_GS_ADD_REMOVE_PROGRAMS.DisplayName0, dbo.v_GS_ADD_REMOVE_PROGRAMS.InstallDate0, 
                      DATEDIFF(Day, dbo.v_GS_ADD_REMOVE_PROGRAMS.InstallDate0, GETDATE()) AS [days since installed]
FROM         dbo.v_R_System INNER JOIN
                      dbo.v_GS_ADD_REMOVE_PROGRAMS ON dbo.v_R_System.ResourceID = dbo.v_GS_ADD_REMOVE_PROGRAMS.ResourceID
GROUP BY dbo.v_R_System.Name0, dbo.v_GS_ADD_REMOVE_PROGRAMS.DisplayName0, dbo.v_GS_ADD_REMOVE_PROGRAMS.InstallDate0, DATEDIFF(Day, 
                      dbo.v_GS_ADD_REMOVE_PROGRAMS.InstallDate0, GETDATE())
HAVING      (DATEDIFF(Day, dbo.v_GS_ADD_REMOVE_PROGRAMS.InstallDate0, GETDATE()) > 0 AND DATEDIFF(Day, dbo.v_GS_ADD_REMOVE_PROGRAMS.InstallDate0, 
                      GETDATE()) < 7)

The Report

Installing the Config Mgr. client on a workgroup computer

Kent Agerlund — Wed, 28 Oct 2009 08:15:00 GMT

In order to successfully discover and install the ConfigMgr. clients on workgroup computers you need to configure a few settings. You need the Server Locator site system role, the proper client installation settings, configure the network discovery method, the Network access account and finally the client push installation account.

Site Systems

When you are working with clients that are not able to query the Active Directory services for ConfigMgr information you need to create a Server Locator Point – SLP. In my example I have one SLP a the central site. The SLP is used by the client during the site assignment process.

Client agent installation settings

My client push account has these settings: smssitecode=s01 smsmp=sea-cfg1 smsslp=sea-cfg1 fsp=sea-cfg1 where sea-cfg1 is the name of my site server and s01 is the site code

In order to use client push I need to define a local account on the workgroup computer. In ConfigMgr. I can create a reference to that account by specifying $computername$\accountname (or %computername%\accountname).

I you have multiple passwords or accounts then specify each of them. ConfigMgr. will try each of the accounts until it succeeds.

Network access account

The network access account is used by the workgroup clients to connect to the configmgr. infrastructure like the distribution points. When specifying the account make sure that it doesn’t have administrative permissions in the domain, a “normal” domain account will do just fine. You specify the account in site settings, client agents, computer client agent.

Network discovery

In order to discover workgroup clients you need to configure Network discovery. Before you configure this make sure that the site server is member of the DHCP users group in the domain (otherwise the DHCP discovery will fail). Also make sure you have restarted the site server after adding the server to the group.

In network discovery I use the DHCP tab and fill in the name or IP address of the DHCP server. Next configure the discovery schedule, make sure that you configure the start 4-5 minutes ahead of the current time (otherwise the discovery process might never start).

Once you have configured these settings you will be able to use client push to install the configmgr. client on workgroup computers. The clients will appear in the administrator console just like a domain computer. Only issue is the approval of the client. By default only domain computers are automatically approved. The approval setting is controlled on the site properties.

The client properties in the Configuration Manager icon.

Troubleshooting tips

To troubleshoot the client push account, monitor the ccm.log file on the site server.

To troubleshoot the network discovery, monitor the netdisc.log file on the site server.

To troubleshoot the client assignment process, monitor the clientlocation.log file on the client.

Configuration Manager 2007 version numbers

Kent Agerlund — Mon, 26 Oct 2009 10:41:39 GMT

With a new service pack also comes a new version number in the ConfigMgr. console:

ConfigMgr RTM Version 4.00.5931.000
ConfigMgr SP1 Version 4.00.6221.1000
ConfigMgr SP2 Version 4.00.6487.2000

Configuration Manager Enterprise license

Kent Agerlund — Fri, 23 Oct 2009 18:39:44 GMT

I have had the question a few times now; Do we need to buy the standard- or the enterprise Configuration Manager license?

Looking at the licesensing website for ConfigMgr. http://www.microsoft.com/systemcenter/configurationmanager/en/us/pricing-licensing.aspx helpes me a little. But I still wasn’t 100% sure so I asked a local Microsoft representative who guided me to this document “The Microsoft Products User Rights” - http://www.microsoftvolumelicensing.com/userights/DocumentSearch.aspx?Mode=3&DocumentTypeId=1 It clarifies the difference between the standard and enterprise license.

ConfigMgr. Standard license covers everything except

Full blown desired Configuration Management.
You can create DCM rules for Basic Operating System Workloads which means
- Operating system utilities like System Resource Manager, Password Change Notification, Baseline Security Analyzer, Reliability and Availability Services
- File and Print services:
  - DFS, File Replication Service (FRS), NFS, FTP and Windows SharePoint Services
- Networking service
  - DNS, DHCP and WINS

So if you create a DCM rule that checks for anything related to another installed programs on a client/server like SQL, SQL configurations etc. then you need to purchase the Enterprise license. For an updated list of what is covered by the Basic Operating System Workload check - http://www.microsoft.com/Systemcenter/operationsmanager/en/us/operations-management-licensing.aspx

Installing the ConfigMgr. client on Windows 7 and Windows 2008 R2

Kent Agerlund — Fri, 23 Oct 2009 07:19:11 GMT

As you most likely know ConfigMgr. 2007 SP2 was released yesterday and can be downloaded from - details.aspx-displaylang=en&FamilyID=3318741a-c038-4ab1-852a-e9c13f8a8140 To successfully install the service pack you need to start the upgrade from the central site and then upgrade child sites and administrator consoles. After the sites have been upgraded it’s time to upgrade the clients. You can use various methods to upgrade the client – check the Technet article for detailed information about the methods - http://technet.microsoft.com/en-us/library/bb694166.aspx

One of the most commonly used methods is using a ConfigMgr. package to perform the upgrade. It works like a charm but when deploying the client to Windows 7 or Windows 2008 R2 you need to pay a little attention to the package.

Creating the ConfigMgr. client upgrade package

Use these steps to create the ConfigMgr. client upgrade package and prepare it to WIndows 7 and Windows 2008 R2.

	Open the ConfigMgr. administrator console, navigate to Software Distribution, Packages. Right click packages and select New Package From Definition.
	This will start the Create package wizard, click Next to proceed.
	In the list of Publishers make sure Microsoft is selected and select the Configuration Manager Client Upgrade package.
	The package must contain source files. The files used in this pacakge are stored in .\Microsoft Configuration Manager\Client on the site server.
	Finish the wizard.
	The package is now created. If you look at programs you can see a single program to perform the installation has been created.
	Open the program properties and select the Requirements tab. In the list of platforms notice that Windows 7 and Windows 2008 is not selected.
	Select the platforms or click This program can run on any platform. Click OK to close the program. You can use the package in your image task sequences and to perform client upgrades – have fun :-)

System Center Configuration Manager 2007 SP2 ready for download

Ronni Pedersen — Thu, 22 Oct 2009 12:44:33 GMT

Service Pack 2 for Configuration Manager 2007 delivers new platform support for Windows 7 client, Windows Vista SP2, Windows Server 2008 R2 and Windows Server 2008 SP2. In addition, Service Pack 2 delivers continued innovation with Intel vPro technology, support for Branch Cache enabled environments, and continued development for 64 bit architectures.

Feature Summary

New Operating System Support

Windows 7

Windows Vista Sp2

Windows Server 2008 R2

Windows Server 2008 SP2

New Features in Out of Band Management
In addition to providing feature parity with SP1 and AMT firmware versions 3.2.1, 4.0 and 5.0, the following new features are supported:

Wireless management with up to 8 wireless profiles

End point access control: 802.1x support

Audit logging

Support for different power states

Power control options at the collection level

Data storage

Scheduling configuration for in-band provisioning

Asset Intelligence Certificate Requirement Removal
Configuration Manager Service Pack 1 introduced Asset Intelligence v1.5. This version allowed customers to configure an online synchronization to ensure that their catalog was up to date with the latest Microsoft inventory for both hardware and applications. This initial release required a certificate. With Service Pack 2, the requirement to have the certificate has been removed, so any customer can configure their Asset Intelligence capabilities to connect online and update their catalog. Software Assurance is not required for this functionality.

64-bit Architecture Development
Service Pack 2 will also continue to deliver new support for x64 architectures, including the following:

X64 support for Operations Manager 2007 Client Agent

Update to Management Packs for 64-bit operating systems - SP2 will ship 64-bit performance counters (the management pack is a separate release)

Remote control support added for x64 XP and x64 Server 2003

Improved Client Policy Evaluation

Faster policy processing

More efficient software distribution configured to run at user logon

Branch Cache Support
Support for scenarios where Windows Server 2008 R2 and Windows 7 Client are present and Branch Cache is enabled

Download System Center Configuration Manager 2007 SP2 here:
http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=3318741a-c038-4ab1-852a-e9c13f8a8140