<CTRL> + Everything

Security Compliance Manager 3.0 (SCM 3.0) beta is now available for download

2012-10-01T19:21:00Z

Security Compliance Manager 3.0 (SCM 3.0) is now available for download! SCM 3.0 is a free tool from the Microsoft Solution Accelerators team that enables you to quickly configure and manage both desktops and servers using Group Policy and Microsoft System Center Configuration Manager. In addition to key features from the previous version, SCM 3.0 offers new Windows Server 2012, Windows 8, and Internet Explorer 10 baselines!

Join the beta now.

Secure your environment with new product baselines for Windows Server 2012, Windows 8, and Internet Explorer 10. The latest version of SCM offers all the same great features as before, plus an enhanced setting library for Windows 7 SP1 and Windows 2008 R2 and bug fixes. The updated setting library gives you the ability to further customize baselines, and also improves GPO Import feature affinity. SCM 3.0 provides a single location for creating, managing, analyzing, and customizing baselines to secure your environment quicker and more efficiently. To learn more about the Security Compliance Manger tool, visit the TechNet Library.

SCM 3.0 provides ready-to-deploy policies and DCM configuration packs that are tested and fully supported. Our product baselines are based on Microsoft security guide recommendations and industry best practices, allowing you to manage configuration drift, address compliance requirements, and reduce security threats.Easily configureWindows operating systems, Microsoft Office applications, and Internet Explorer with industry leading knowledge and fully supported tools.

Next steps:

Join the SCM 3.0 beta. Click here to join the beta and get the latest version of the tool.

Tell us what you think! Test drive the beta release, and send your constructive feedback to secwish@microsoft.com. We value your input; this is the perfect opportunity to be heard.

Tell your peers and customers about Security Solution Accelerators! Please forward this to anyone who wants to learn more about security and Microsoft Solution Accelerators.

Already using Security Solution Accelerators? We’d like to hear about your experiences. Please send comments and suggestions to secwish@microsoft.com. Want more information on a specific feature? Interested in
speaking with the development team? Please contact Venkat Ganti.

Integrating MDT 2012 RTM with Configuration Manager 2012 RTM–Part 3 : Creating and deploying a UDI Task Sequence

2012-06-01T00:02:00Z

User Driven Installation lets your end users control the OS deployment and you can let them select things like the computer name, Add themselves to the local admin group, select the Image, select the domain and the OU, enable bit-locker, applications to deploy etc. With the integration of SCCM 2012 and MDT 2012 you can use a single infrastructure and merge the benefits of these two different tools.

If you are interested to see how to step-by-step create a User Driven Installation Task Sequence you’ll find this post helpful and you can share under comments if you have any specific questions.

To create a UDI Task Sequence you’ll start by a right click on Task Sequences under Software Library > Operating Systems and select to create a MDT Task Sequence.

Select User Driven Installation Task Sequence

Give a name to the Task Sequence

Select the domain to join (This options can be defined from the UDI Wizard designer as well)

Select if you want to use this Task Sequence to capture the OS image

Select the boot image to use with the Task Sequence. Be sure to select the same architecture boot image as the OS image.

Select a package for the MDT 2012 files if you have it created already, OR create a new one with a UNC path

Fill Details for the MDT package if you have selected to create one.

Select the OS Image package. You can also create a new image package if you have not yet created one.

Select the Configuration Manager Client package for client installation. You should create a new package from definition for Config Mgr client, in advance.

Select or create a new USMT 4.0 Package. You’ll need to have WAIK for Windows 7 installed in order to do this.

Select or create a new MDT settings package.

If you selected to create a new MDT settings package, the provide details about it.

follow the rest of the wizard and wait to see results. make sure there we no errors.

Now, you can deploy the UDI Task sequence to the collection of Unknown Computers.

Once you boot a machine and select the UDI Task sequence, you’ll see the default screen that comes with the UDI Wizard.

and you can proceed with the image deployment.

In the next post, I will talk about creating custom UDI Wizards and using them with your task sequences. Stay tuned!

Integrating MDT 2012 RTM with Configuration Manager 2012 RTM - Part 1 : Installing MDT 2012

http://blogs.technet.com/b/anilm/archive/2012/05/06/integrating-mdt-2012-rtm-with-configuration-manager-2012-rtm-part-1-installing-mdt-2012.aspx

Integrating MDT 2012 RTM with Configuration Manager 2012 RTM - Part 2 : Configuring Integration

http://blogs.technet.com/b/anilm/archive/2012/05/06/integrating-mdt-2012-rtm-with-configuration-manager-2012-rtm-part-2-configuring-integration.aspx

System Center Cloud Services Process Pack available for Service Manager 2012 RTM

2012-05-13T00:01:04Z

A new version of System Center Cloud Services Process Pack is available for download now. This will work with Service Mnager 2012 RTM so if you are one of the enthusiasts waiting after RTM installation, go grab it!

Its available under System Center 2012 – Service Manager Component Add-ons and Extensions

http://www.microsoft.com/en-us/download/details.aspx?id=28726&WT.mc_id=rss_alldownloads_all

System Center Cloud Services Process Pack
This process pack will offer a self-service experience to facilitate private cloud capacity requests from your business unit IT application owners and end users, including the flexibility to request additional capacity as business demands increase.

Integrating MDT 2012 RTM with Configuration Manager 2012 RTM - Part 2 : Configuring Integration

2012-05-05T23:08:00Z

To configure the integration between MDT 2012 and SCCM 2012:

1. Go to Start > All Programs > Microsoft Deployment Toolkit

2. Select Configure ConfigMgr Integration

On the first screen, fill out details of configuration manager Primary site server and click Next (Use the removal option if you had any previous integration in place)

Review installation results and make sure it completed successfully and click Finish.

To verify the integration:

Open Configuration Manager server console from the Primary site server which you selected during the MDT 2012 integration process. It will not be visible from the Central site server or any other primary site server, if you have multi server infrastructure.

Go to Software Library > Operating Systems and right click on Task Sequences

Notice the new option to Create MDT Task Sequence

In next posts I'll talk about configuring User Driven installation using MDT 2012 and SCCM 2012. Stay Tuned!

Integrating MDT 2012 RTM with Configuration Manager 2012 RTM - Part 1 : Installing MDT 2012

2012-05-05T22:53:29Z

Download MDT 2012 from: http://www.microsoft.com/en-us/download/details.aspx?id=25175

Before you start the installation from the MSI installer make sure the prerequisites are in place.

Some of the common Prerequisites for installing MDT 2012 are:

Microsoft Management Console version 3.0
Microsoft .NET Framework 3.5 with Service Pack 1 (SP1)
Windows PowerShell™ version 2.0

Windows AIK for Windows 7 (download from http://www.microsoft.com/en-us/download/details.aspx?id=5753 )

Now since we are going to integrate MDT 2012 with Configuration Manager 2012, make sure you have a Configuration Manager 2012 Primary site installed. If not follow the article: "http://blogs.technet.com/b/anilm/archive/2012/01/15/how-to-install-the-configuration-manager-2012-primary-site.aspx "

Installing MDT 2012 RTM

Launch MDT msi installer after you download and follow all the steps as described with screenshots below:

On this step, you can choose a different location for the MDT installation path

Validate Microsoft Deployment Toolkit appears under programs on your system.

In the next post I’ll share how to integrate MDT 2012 with SCCM 2012 server. Stay tuned!

Managing workgroup clients in Configuration Manager 2012

2012-05-05T22:04:24Z

The Server Locator Point is no more a separate site system role in SCCM 2012. It's functionality is merged into the Management Point.

To install CM12 client on workgroup machines:

Make sure your Management Point is published on DNS or WINS

Make sure Management Point FQDN can be resolved from the client machine

For the client installation on Workgroup machines use the CCMSetup.exe with local Administrator previledge

CCMSetup.exe and its supporting files are located on the System Center 2012 Configuration Manager site server in the Client folder of the System Center 2012 Configuration Manager installation folder. This folder is shared to the network as <Site Server Name>\SMS_<Site Code>\Client.

At the command prompt, the CCMSetup.exe command uses the following format:

CCMSetup.exe [Ccmsetup properties] [client.msi setup properties]

For example, CCMSetup.exe /mp:SMSMP01 /logon SMSSITECODE=S01 FSP=SMSFSP01 performs the following actions:

Specifies the management point named SMSMP01 to request a list of distribution points to download the client installation source files.

Specifies that installation should stop if a version of the System Center 2012 Configuration Manager or Configuration Manager 2007 client already exists on the computer.

Instructs client.msi to assign the client to the site code S01.

Instructs client.msi to use the fallback status point named SMSFP01.

In a scenario where you haven't published Management Point to Active Directory but want to manage domain clients with SCCM 2012, you can use Client push installation method with additional properties for client.msi (make sure Step 1 and 2 are followed)

SMSSITECODE=XYZ SMSMP=SCCM2012.domain.com FSP=SMSFSP01 DNSSUFFIX=domain.com

Reference articles on TechNet:

Planning for Communications in Configuration Manager

http://technet.microsoft.com/en-us/library/gg712701.aspx

About Client Installation Properties in Configuration Manager

http://technet.microsoft.com/en-us/library/gg699356.aspx

MDT 2012: Reliable and flexible OS deployment—now with support for System Center Configuration Manager 2012

2012-04-20T16:12:00Z

The latest version of the Microsoft Deployment Toolkit—version 2012— is now available for download.

Visit the Download Center to download MDT 2012.

Deploy Windows 7, Office 2010, Windows 8 Consumer Preview, Windows Server “8” Beta and Windows Server 2008 R2 with the newly released Microsoft Deployment Toolkit (MDT) 2012. MDT 2012 is the newest version of Microsoft Deployment Toolkit, a Solution Accelerator for operating system and application deployment. MDT is the recommended process and toolset for automating Windows 7 and Office 365 deployments.

The Solution Accelerators Team added new features to MDT 2012 that include the ability for users to initiate and customize their own deployments using System Center Configuration Manager 2012, key enhancements in Windows 7 driver support, and much more.

MDT 2012 will provide new benefits such as:

Comprehensive tools and guidance to efficiently manage large-scale deployments of Microsoft Office 2010.
An enhanced User-Driven Installation (UDI) deployment method that utilizes System Center Configuration Manager 2012. UDI lets end users initiate and customize an
OS deployment on their PCs—via an easy-to-use wizard.
Ease Lite Touch installation with new capabilities to check on the status of currently running deployments.
This release provides support for deploying Windows 8 Consumer Preview in a lab environment.

These features, combined with many bug fixes and other improvements, make MDT 2012 more reliable and flexible than ever.

Support for Configuration Manager 2012: MDT 2012 provides support for Configuration Manager 2012 releases. MDT 2012 fully leverages the capabilities provided by Configuration Manager 2012 for OS deployment. Users now also have the ability to migrate MDT 2012 task sequences from Configuration Manager 2007 to Configuration Manager 2012.

Customize deployment questions:For System Center Configuration Manager customers, MDT 2012 provides an improved, extensible wizard and designer for customizing deployment questions.

Ease Lite Touch installation: The Microsoft Diagnostics and Recovery Toolkit (DaRT) is now integrated with Lite Touch Installation, providing remote control and diagnostics. New monitoring capabilities are available to check on the status of currently running deployments. LTI now has an improved deployment wizard user experience. Enhanced partitioning support ensures that deployments work regardless of the
current structure.

Secure Deployments: MDT 2012 offers integration with the Microsoft Security Compliance Manager (SCM) tool to ensure a secure Windows deployment from the start.

Reliability and flexibility: Existing MDT users will find more reliability and flexibility with the many small enhancements and bug fixes and a smooth and simple upgrade process.

Support for Windows 8: MDT 2012 provides support for deploying Windows 8 Consumer Preview and Windows Server “8” Beta in a lab environment.

Next steps:

Download MDT 2012.
Send your comments to the MDT Team.
Learn more about the MDT.

Get the latest tips from Microsoft Solution Accelerators—in 140 characters or less! Follow us on Twitter: @MSSolutionAccel.

Solution Accelerators background information

The Microsoft Assessment and Planning Toolkit, Microsoft Deployment Toolkit, and Security Compliance Manager provide tested guidance and automated tools to help you plan, securely deploy, and manage new Microsoft technologies—easier, faster, and at less cost. All are freely available, and fully supported by Microsoft.

Planning your migration to new Microsoft technologies

Use the Microsoft Assessment and Planning Toolkit to inventory your IT environment and assess your hardware readiness for migration to Windows 7, Windows Server 2008 R2, Hyper-V, and Microsoft Office 365—in just a few hours. MAP automatically generates detailed reports on hardware, device, and application compatibility—information you can immediately put to work in your migration plans.

Securely deploying and managing new Microsoft technologies

The Microsoft Deployment Toolkit and the Security Compliance Manager are the essential toolset to automate your desktop and server deployment of new Microsoft technologies. Using MDT and SCM, you can significantly reduce the costs and time to securely deploy and manage Windows 7, Windows Server 2008 R2, Hyper-V, and Microsoft Office 2010 across your organization.

How Configuration Manager 2012 helps to make my Inventory more accurate?

2012-02-25T17:05:00Z

Inventory reports with stale records have been one of the pain areas for Administrators. The poor client health with no auto-remediation and inefficiently configured maintenance tasks are major reasons behind it.

Configuration Manager 2012 is going to be the true friend of IT administrators and managers when it comes to address these challenges. Here I'll talk about some key strengths of CM 2012 to improve your reporting accuracy when it comes to inventory reports, deployment status reports and other reports.

System Discovery: System Discovery settings now have a new tab with some new options to exclude inactive machines. You can include last logon times and last computer account password update parameters to be checked before a machine is placed into the SCCM database.

To find the option: go to Administration Wunderbar > Overview > Hierarchy Configuration > Discovery Options

Client Status Settings: After clients have been deployed you need to ensure that these clients remain managed as long as they are part of your environment. Client status settings help you to define evaluation periods for client activity based on which you can flag the client as Active or inactive. Also you can define for how long inactive client data should be retained by configuration manager from this settings box. If client performs any of these actions it will be considered active.

Here is a TechNet article which talks more about how to monitor client health in CM 2012: http://technet.microsoft.com/en-us/library/gg682128.aspx

Site Maintenance tasks: Site maintenance tasks are still going to help with clearing CM database of inactive, obsolete and old records.

A client will be marked inactive based on client status settings as well as if its marked obsolete. You can setup your site maintenance tasks to timely clear inactive/obsolete and old client records.

Client Auto remediation: Clients in CM 2012 run a local client health check and attempt auto remediation if needed. The ccmeval.xml file under C:\Windows\CCM defines ideal health state parameters and if anything deviates from this expected state, it is automatically fixed by the process. Additionally a report is also sent to the site server if there is any change in the health state of the client.

If you would like to see logs related to client health evaluation and remediation check inside C:\windows\CCM\Logs for ccmeval.log

Note: All the screenshots and the topics discussed here are based on SCCM 2012 RC2 and it might change in RTM release.

Top 10 actions after installing Configuration Manager 2012

2012-02-23T23:59:00Z

Question: I have successfully Installed Configuration Manager 2012, with one Central Administration site and two Primary site servers. Okay, so what do I do next and where to start from?

Answer: This is well documented in the TechNet library and here is how I would prioritize a few must do things, after you install Configuration Manager 2012 site servers:

On the topmost site server in your hierarchy

Configure Discovery Options (http://technet.microsoft.com/en-us/library/hh427340.aspx)

Add new boundaries (http://technet.microsoft.com/en-us/library/hh427326.aspx)

Create Boundary groups and assign site to a boundary group

Make sure that your site system can publish site information to Active Directory Forest (http://technet.microsoft.com/en-us/library/hh696542.aspx)

This will also required you to have AD schema extended and SCCM site server to have full rights on Systems Management Container.

Configure Client Settings for Client Management (http://technet.microsoft.com/en-us/library/hh427330.aspx)

You can also create custom client settings instead of default setting to target on selected devices through collections

To automate client installation, configure Client Push Installation settings or any other method which works for you (http://technet.microsoft.com/en-us/library/gg712298.aspx)

Configuring Alerts in Configuration Manager (http://technet.microsoft.com/en-us/library/hh427334.aspx )

Add necessary Distribution Points and Create Distribution Point groups (http://technet.microsoft.com/en-us/library/hh427335.aspx)

You can also assign collections to Distribution group boundaries

Configure Site Components (http://technet.microsoft.com/en-us/library/hh427329.aspx)

Add new site system roles (http://technet.microsoft.com/en-us/library/hh272770.aspx )

There are some roles which depend on your CM 2012 hierarchy
e.g. if you have a CAS, Software Update Point has to be first enabled on CAS server, which will serve as a upstream server in the hierarchy to distribute Updates
metadata.
Endpoint Protection point can only be enabled on the topmost site in the hierarchy.
Asset Intelligence synchronization point to be installed on topmost site.
Reporting services point is also recommended to be installed on CAS
Similarly there are other roles related to device enrollment and Application catalog which will be installed on a Primary site.
If you only have one server, you need not worry :) you can put everything on the same box!

To monitor Client Health:

10. Configure Alerts from Device collection properties (http://technet.microsoft.com/en-us/library/hh427334.aspx)

How to enable Configuration Manager 2012 Endpoint Protection

2012-02-18T19:30:49Z

In case you have not yet tried enabling Endpoint Protection in CM 2012 and wondering how to do it, let me try to help you.

One of the most important things to determine Is where to install the Endpoint protection Point role in your CM 2012 hierarchy. If you have a CM 2012 standalone primary site server, you can enable the Endpoint Protection Point site system role on the Standalone primary site server. If you have a Central Administration Site (CAS) server, then you need to enable the Endpoint Protection point site system role on the CAS server.

Now you follow these two articles from TechNet to determine prerequisites for Endpoint Protection and the process of enabling the endpoint protection.

Prerequisites for Endpoint Protection in Configuration Manager 2012

http://technet.microsoft.com/en-us/library/hh508780.aspx

How to configure Endpoint Protection in Configuration Manager 2012

http://technet.microsoft.com/en-us/library/hh508770.aspx

If you want to deploy endpoint protection in a phased manner to your desktop environment, you can create custom client device settings to enable Endpoint Protection agent and target these settings on a new collection with desired workstations/servers. Once you have done testing to your satisfaction you can simply add new workstations by subnets or AD sites any other smart logic.

In case you have an existing third party AV agent installed on your computers and in case SCCM fails to remove that agent and fails to install, you can use application packages to deploy a script/ command line/ executable/ MSI which will remove the third party agent prior to enabling Endpoint Protection agent.

To track the endpoint protection agent deployment status, go to monitoring section and select the collection you want to track, and review results.

What is new about System Center 2012 Endpoint Protection?

2012-02-04T23:23:00Z

"System Center 2012 Endpoint Protection is going to consolidate desktop security and management into a single on-premise solution"

So what's new? It been there ever since FEP 2010 was integrated into SCCM 2007. Is there anything new about it? What is going to change for a business user? These are a few questions which I will try to answer in this post.

First of all it is now called System Center 2012 Endpoint Protection! EP2012 is what I'll call it mostly in this post :)

And some of the key highlights are:

It Builds on Configuration Manager 2012 User Centric Approach

You might have already found that Configuration manager 2012 is bringing the User Centric approach, Unified Infrastructure, User Empowerment, Simple Administration and more. So 2012 Endpoint Protection is also going to take advantage of those benefits. With the User Centric approach, you'll see more information around users rather than just systems. It means that Endpoint protection now helps you to identify users who are more prone to bring malware into the environment and need to be trained on security best practices.

Administrators can control any reboots that might be required after the EP agent installation, upgrade or definition update or can give control to end users to restart they devices conveniently.

Lesser Infrastructure required

Another benefit is the lesser infrastructure required to operate Endpoint Protection 2012. In FEP 2010 with SCCM 2007, we still required WSUS to configure auto-approval rules for definition updates, which will be replaced by Automatic Deployment Rules in EP 2012.
Policies will be distributed via Configuration Manager policy infrastructure (you might be familiar with Management Point) and now it doesn't require the complexity of packages and programs for this task.
The refresh cycle for antimalware and firewall policies will also be controlled by the client's polling interval (60 minutes by default).
EP 2012 has randomization at deadlines, so the load on the infrastructure during Definition Updates, Quick scan or Full Scan there will be reduced. This will also minimize the performance impact in VDI environments.

More up to date Endpoint Protection Dashboard

Any changes on the EP client like definition updates, malware detections will be sent to the server whenever the event happens. Hence the status update is up to date on the Endpoint Protection Dashboard.

Built-in role for Endpoint Protection Manager

The predefined role lets you easily grant permissions to a new administrator, and makes sure that he does not mess-up with anything else on the console. Compare this with assigning security classes, instances and permissions in SCCM 2007!

*Screenshot taken from a Configuration Manager 2012 RC2 installation

Central Policy Creation

For a multi site environment with one Central Administration Site( CAS site ), one will now create and assign policies from the CAS site server itself. Administrator can easily create policy using a template and assign to a collection and control the relative priority among policies.

Control alerts at Collection level

Administrators can apply antimalware settings per collection and can also control alert settings from collection properties. This helps to focus on critical group of machines than getting everything highlighted on the dashboard.

*Screenshot taken from a Configuration Manager 2012 RC2 installation

Active Dashboard and remediation

The Dashboard now includes links to affected collections of machines, so you can see a list of computers affected on console itself (earlier you were forced to go to reports)

*Screenshot taken from a Configuration Manager 2012 RC2 installation

Administrator can also force a policy based action from the console itself on the affected group of machines.

*Screenshot taken from a Configuration Manager 2012 RC2 installation

So these are some of the highlights of System Center 2012 Endpoint Protection. In my coming posts I will talk about how to setup Endpoint protection using Configuration Manager 2012 RC2, so stay tuned!

Using SCCM R3 Pre-Stage Media feature to prestage OS Deployments

2012-01-21T04:30:10Z

Cross posted from PTS Blogs http://blogs.technet.com/b/ptsblog/archive/2011/03/02/using-sccm-r3-pre-stage-media-to-prestage-os-deployments.aspx

In this post I’ll demonstrate how to use System Center Configuration Manager 2007 R3 to create prestaged media, and then prestaging the operating system (OS) image on a fresh hardware using a Task Sequence. Afterwards, we will install the operating system using the prestaged OS media.

Part 1 : Creating Prestage Media using Task Sequence

Right Click on the Task Sequence and select Create Task Sequence Media

Select option to Create Prestaged Media

Specify Publisher Information
Specify Name and Destination of the output file. This file will be used as Prestaged OS Image later

Select Boot Image and OS Image to be used. Make sure to select both Images of same architecture.

This process will create an output WIM file under the location you specified in the Wizard.

Part 2: Add Prestaged Operating System Image

Once the WIM file is created, next step is to create an OS Image under Operating System Deployment node.

Right Click on Operating System Images and select Add Operating System Image

Input the UNC path of the WIM file captured in Create Prestage Media part

Add General information about the Image

Part 3: Create a task sequence to Prestage the OS Image on a machine

Right Click on Task Sequences and select New Task Sequence
Select Custom Task Sequence on first page of the Wizard
Give it a name and select the Boot Image and hit Finish

Add First Task to Format and Partition Disk
Go to Partition Properties and provide Inputs against Partition Name and Variable at the end. Allocate disk space to the partition and select File System.

Goto Add > General > Run Command Line

Give it a Name and Input Command Line as following

%SystemRoot%\system32\bootsect.exe /nt60 %OSPartition%

%OSPartition% here is the variable value we defined under Partition properties

Select Add > Images > Apply Data Image

Select Image Package (Created in Part 2)
Select Destination “Logical Drive Letter Stored in a variable” and Provide ‘OSPartition’ as Variable Name (this is the variable name provided under Partition Properties)

Add a new Command Line and input following command

X:\windows\system32\wpeutil.exe shutdown

Add another command line with command cmd.exe /k

Part 4: Apply an OS Image using Prestaged Media from Disk without downloading from the Distribution Point

In Part 3, we created a Task Sequence to prestage an OS Image on a fresh machine. Now in this part we’ll apply an operating system to that machine by using the prestaged media on the disk. By just adding a Condition we can skip the OS Image download process. Prestaged media on creation will set _SMSTSMediaType = OEMmedia and we can use this variable as a condition to be checked before partitioning the disk and downloading OS Image from the distribution point.

Open a Task sequence to Deploy OS to fresh hardware. Go to Options tab under Format and Partition Disk Step. Select to Add Condition and select Task Sequence Variable

Add Variable Name, Condition and Value as in the picture below

This is all you need to change in the Task Sequence used to deploy Operating System to new hardware (with Prestaged OS Image) and it will not download OS Image from the network!

How to Install the Configuration Manager 2012 Primary site

2012-01-15T03:07:00Z

Cross posted from PTS Blogs http://blogs.technet.com/b/ptsblog/archive/2011/12/16/how-to-install-the-configuration-manager-2012-primary-site.aspx

Previous Post: How to Install the Configuration Manager 2012 Central Administration Site

On the primary site server, again make sure you have following components available.

1. Make sure you have x64 Windows server 2008 Operating System

2. Install supported version of SQL server 2008 (for Configuration Manager 2012 RTM you must have SQL 2008 SP2 with CU9 or SQL Server 2008 R2 with SP1 and Cumulative Update 6 or SQL Server 2008 SP3 with CU4)

You can use a network account
Install Integration Services, Analysis Services, Reporting Services, Database Engine and management tools
Add the current account to SQL administrators group

*These configurations required for SQL might be updated in future from Microsoft, so kindly visit TechNet for updated versions - http://technet.microsoft.com/en-us/library/gg682077.aspx#BKMK_SupConfigSQLDBconfig

3. Extend the Active Directory Schema with Schema Administrator's rights ( <CM2012Media>\SMSSETUP\BIN\I386\extadsch.exe)

4. Install .Net Framework 4.0

5. Add IIS as a role, with ASP.Net, ASP

6. Under Features, add BITS and Remote Differential Compression

7. If you do not have internet connection on the Configuration Manager server, make sure you have Configuration Manager updates downloaded from the link highlighted below on the first screen of setup.

Installing the Configuration Manager 2012 Primary site

1. Double click on Splash.hta from the CM 2012 install media

2. Click on Install , once you have all prerequisites in place

3. Select Install a Configuration Manager Primary Site and hit Next

2. Point to available updates for CM 2012, downloaded previously. Or you may download again.

3. Provide Site Code, Site Name and Installation folder location on local disk.

4. Select to join the site to an existing hierarchy. Provide CAS site server name.

5. Provide SQL database information

6. Select the client communication settings. Go with second option, unless you have all certificate requirements in place.

7. Select to install MP and DP in HTTP mode

8. Follow rest of the Wizard and you are done :)

How to Install the Configuration Manager 2012 Central Administration Site

2012-01-15T02:58:00Z

Cross posted from PTS Blogs http://blogs.technet.com/b/ptsblog/archive/2011/12/16/how-to-install-the-configuration-manager-2012-central-administration-site.aspx

When I recently had to install Configuration Manager 2012 in my lab setup, I thought of capturing screenshots. I installed a Central Administration Site and a Primary site attached to it.

Here is a high level overview of all steps involved:

1. Make sure you have x64 Windows server 2008 Operating System

You can use a network account
Install Integration Services, Analysis Services, Reporting Services, Database Engine and management tools
Add the current account to SQL administrators group

3. Extend the Active Directory Schema with Schema Administrator's rights ( <CM2012Media>\SMSSETUP\BIN\I386\extadsch.exe)

4. Install .Net Framework 4.0

5. Add IIS as a role, with ASP.Net, ASP

6. Under Features, add BITS and Remote Differential Compression

9. Install Central site with Steps listed below

Installing Central Administration Site

1. Double click on Splash.hta from the CM 2012 install media

2. Click on Install , once you have all prerequisites in place

3. Select "Install a Configuration Manager Central Administration Site"

4. Accept Terms and Conditions (I hope you go though all Terms and conditions :) ...)

5. Download Updates to a location or if you have already downloaded, point wizard to that location

6. Select the language

7. Select Client Language

8. Provide Site Code, Site Name and Installation Folder location on local drive

9. Provide SQL Database information (Make note of the SQL Server Service Broker at the bottom )

10. Follow the rest of the wizard and Complete the installation

11. If any prerequisite is missing the SCCM will inform you, before it starts the installation. Fix all prerequisites and proceed.

The next post will discuss how to install the Configuration Manager 2012 Primary Site.

Configuration Manager 2012 RC: What's new in Software Update Management?

2012-01-15T02:38:38Z

Cross Posted from PTS Blogs: http://blogs.technet.com/b/ptsblog/archive/2011/12/19/configuration-manager-2012-rc-what-s-new-in-software-update-management.aspx

Configuration Manager 2012 is introducing a lot of changes in update deployment procedures. Most of the changes are around the "HOW" part while there are some new concepts too.

In this post I'll talk about what some of the changes are around:

Configuration of Software Updates components
Deployment of software updates to endpoints
Monitoring and tracking deployment status

Configuration of Software Updates Components

1. Software Update Point

a. If you have a Central Administration site in your design, you'll first need to have the Software Updates Management Site role installed on your Central Administration Site (CAS) server before you install this role on any other primary site server. The CAS Software update point will work as the upstream server for all updates and all primary sites.

b. If you have a single primary site server, you can install Software update point on the same server.

2. Now you'll find the Software Update Point configuration option under sites, Configure Site Components on the ribbon bar or if you right click on the site server

3. Supersedence Rules - helps you to control when a superseded update should be expired, so that the changes reflect accordingly on your SCCM compliance reports.

a. You can now opt to immediately expire a superseded software update

b. OR expire a superseded update after a specified time

4. Under Client Settings, Software Updates, now you'll see an additional option to install all updates meeting deadline in a specified future time. This option will save you from multiple restarts on computers.

Software Update Deployment

1. Filter Updates - The same concept of search folders , and you can easily add a criteria from the drop down list. Save search criteria with a name and use it every next time. Very helpful for your monthly deployments for different categories of machines.

2. Software Update Groups - Same concept of Update lists, but it will also include the deployment. Saves you from going to another folder to manage deployment.

3. Automatic Deployment Rules - This is what most of SMB customers were looking for. Now you can automate your monthly patch deployments for Workstations (or even servers) as well as for Forefront Endpoint Antivirus definition updates. You can also opt to perform deployment manually, by simply doing a right click and select "Run now".

4. More controls to end users under Software Center.

Monitoring and tracking deployment status

Alerts and Deployment status summary - In console alerts save you from switching screens between console and SCCM reports to track compliance data.

Click on the View Status hyperlink and you'll get detailed status summary.

Finally, you can also view and control alerts from the console.

Configuration Manager 2012 RC: Configure Software Catalogue portal and publish applications

2012-01-15T02:35:22Z

Cross Posted from PTS Blogs: http://blogs.technet.com/b/ptsblog/archive/2011/12/20/configuration-manager-2012-rc-configure-software-catalogue-portal-and-publish-applications.aspx

The Software Catalogue portal is a cool new feature in System Center Configuration Manager 2012. Administrators can publish applications for end users, and optionally they can enforce authorization before actual deployment of the application. I tried to configure the feature in the release candidate of Configuration Manager 2012 and captured screenshots at each important step.

Before you start to configure the Application Catalogue, look for prerequisites at the following TechNet link

Prerequisites for Application Management in Configuration Manager

Now, Right click on one of the SCCM 2012 Primary site systems, to add new Role.

Select Application Catalog Web Service Point and Application Catalog Website Point

You may specify a name for the web application

Provide Organization name and web theme.

That done, you have the website ready but you still need to publish applications for users.

1. Publish Application to Catalogue, from application properties > Application Catalog tab.

2. Deploy application to all users. Make it available and (optionally) set "approval required" if users requests application .

Finally, define Application Catalog synchronization frequency. Right click on site server and go to "Site Maintenance" option. Scroll down to the bottom of the list and select Update Application Catalog Tables option. In to properties define an interval in minutes.

Configure Application Catalogue update setting

User Experience

When a users opens the application catalog website, he can see a list of published applications and request application.

If an application requires approval before deployment, the administrator will see a pending approval request under Application Management. Administrators can either approve or deny the deployment request and also write comments.

Once approved, the client will see the following on their workstation

Deploy Task Sequence option greyed out in CM 2012 RC

2011-12-03T22:10:39Z

When I tried to deploy a Task Sequence in CM 2012, I noticed two surprising elements.

One, that the Deploy Task Sequence option was greyed out. I checked almost everything related to the task sequence, but found nothing that could change the status. My colleague Sreekanth had already went through the same pain, and found that the Format and partition disk TS was throwing an error, if you go to the properties of the TS.

To fix the problem, I went to edit the TS and removed the existing Partition disk step and replaced it with a new Format and partition disk TS. Saved the TS and again tried to deploy it. Worked this time!!

Operating System Deployment with System Center Configuration Manager 2012 Beta

2011-11-26T01:06:00Z

This article is cross posted from my original post on PTS Official Blog

A few days back, I configured OS deployment in System Center 2012 Configuration Manager Beta 2 to deploy a Windows 7 Image, which I had captured using Configuration Manager 2007. It was all in a Hyper-V environment so no drivers were to be included in this scenario. I wanted to share an illustrated walkthrough of the process.

A high level overview of the steps taken in Configuration Manager 2012

Added a WDS role on my Configuration Manager site server
Added a DHCP scope on my Domain Controller
Enabled a PXE service point on my Distribution Point under Configuration Manager 2012 site systems
Enabled Unknown computer support
Distributed both x86 and x64 Boot images to the Distribution Point
In Boot file properties, under Data Source tab checked the option : "Deploy this boot image from the PXE service point "
Added an OS Image for Windows 7 and distributed it to the distribution point
Created a task sequence to deploy the OS image using x64 boot image, after formatting the disk
Assigned the task sequence to a Collection, under device collections.

Step 1 : Add a WDS Role

The Windows Deployment Services role is required on the server where we'll have a distribution point with PXE service enabled.

A high level overview of the steps taken in Configuration Manager 2012

Added a WDS role on my Configuration Manager site server
Added a DHCP scope on my Domain Controller
Enabled a PXE service point on my Distribution Point under Configuration Manager 2012 site systems
Enabled Unknown computer support
Distributed both x86 and x64 Boot images to the Distribution Point
In Boot file properties, under Data Source tab checked the option : "Deploy this boot image from the PXE service point "
Added an OS Image for Windows 7 and distributed it to the distribution point
Created a task sequence to deploy the OS image using x64 boot image, after formatting the disk
Assigned the task sequence to a Collection, under device collections.

Step 1 : Add a WDS Role

The Windows Deployment Services role is required on the server where we'll have a distribution point with PXE service enabled.

Step 2: Add a DHCP scope in the network segment where you plan to deploy OS images using network boot.

Step 3: Enable PXE service point on the distribution point

a. Under Administration workspace, go to properties of Distribution Point Role

b. Go to PXE tab and enable PXE service point (circled in picture below)

Step 4: Enable Unknown Computer support

Step 5: Distribute Boot images to the Distribution Point

a. Under Software Library workspace, go to Operating Systems and click on Boot Images

b. Right click on a boot image and select Distribute Content option

c. Click Next on the first page of the wizard

d. On the Content Destination page, click on Add button and select either Distribution Point or Distribution Point Group

e. Select the Distribution Point group or Distribution Point and follow the rest of the wizard

f. Follow the same process for the other boot image as well.

Step 6: Set boot image properties

a. Right click on the boot image and select Properties.

b. Go to Data Source tab and select "Deploy this boot image from the PXE service point"

c. Click OK and follow the same process for the other boot image as well.

Step 7: Added an OS Image and distributed it to the distribution point

a. Under Software Library workspace, go to Operating Systems and right click on Operating System Images

b. Select "Add Operating System Image

c. Locate the OS image file ( .wim extension) on the network and follow the rest of the Wizard providing name and other information

Step 8: Create a Task Sequence

a. Under Software Library > Operating System, right click on Task Sequences and select 'Create Task Sequence' option

b. Select the option to include existing image package and follow the wizard which is similar as in Configuration Manager 2007.

Step 9: Assigned the task sequence to a Collection, under device collections

a. Right click on the desired Task Sequence and select Deploy

b. Select the collection where you need to target the image deployment. For fresh machines you can either choose Unknown computers, OR if you have imported computer information in a separate collection, you can target that.

Welcome !

2011-07-15T15:26:00Z

Hello and welcome to my first blog post.

My name is Anil Malekani, and I work as a Partner Consultant at Microsoft. In this position I work with Microsoft Partners to provide consulting to our customers and partners in areas like System Center, Forefront Endpoint Protection and Rights Management.

I’m very excited about the System Center suite of products like System Center Configuration Manager, System Center Operations Manager, System Center Service Manager, Data Protection Manager, Virtual Machine Manager and more. To read more about System Center product family visit http://www.microsoft.com/systemcenter/en/us/products.aspx . System Center plays a key role in moving an IT organization towards Dynamic IT.

In my coming posts I would share my experience, thoughts and opinion on technology but you can expect me talking about System Center most of the time

Stay tuned !