Configuration Manager OSD

SP1 Setup Changes – System Center 2012 Configuration Manager

2012-07-20T13:58:00Z

The CTP for System Center 2012 SP1 is now available. What’s new in Service Pack 1 for System Center 2012 Configuration Manager? I’ll walk through a few things that will get you acquainted with the changes in this release over the next couple blog posts.

Setup changes

Starting with SP1 we will add support for managing and deploying Windows 8 and Windows Server 2012 (for the CTP you need to use the release preview). As we add this support we moved from using the Windows AIK (WAIK) that was used for deploying Windows 7 and previous versions to the Windows Assessment and Deployment Kit (ADK). So what does that mean to the IT Pro? Let me walk through the changes……

First, the setup experience is going to change. In previous releases we included the WAIK on the Configuration Manager media. Starting with SP1 this will no longer be included with the media. The Windows ADK will need to be downloaded and installed prior to running Configuration Manager SP1 setup. The pre-req check component will check to ensure the required ADK components are installed on the server and halt setup if the required components are not present. This is similar to what we do for things like SQL.

What parts of ADK do I need? There are few components needed depending on the role being setup.

Top Level site – (Central Administration Site or Standalone primary site)

Windows Deployment Tools
Windows PE
User State Migration Tool

Primary Site Server

Windows Deployment Tools
Windows PE

Provider

Windows Deployment Tools
Windows PE

When you first install the ADK there is an option to download and reuse it the files for other installations, this is an easy way to perform setup quickly throughout your environment.

Note: If you are installing a remote provider, make sure you have the pre-reqs in place prior to running the new site role wizard. Since this wizard does not setup the role interactively you will not know that the installation failed until you read the logs.

Another change you will see in setup is the package is automatically created for the User State Migration Tool for Windows 8. The package is created at the top level site and the content source is also referenced to the top level site.

For the SP1 release we will be adding support for the following OSD server roles:

Windows Server 2012 - Distribution Point with PXE and Multicast
Windows Server 2012 – State Migration Point
Windows 8 Enterprise x86 and x64 – Distribution Point

I expect to have some more posts on Configuration Manager OSD for Service Pack 1 shortly….

John Vintzel
Microsoft Corporation| Sr. Program Manager | System Center Configuration Manager | twitter: jvintzel
http://blogs.technet.com/b/inside_osd

This posting is provided "AS IS" with no warranties, and confers no rights.

Managing Unprovisioned Computers in System Center 2012 Configuration Manager

2012-05-02T14:00:00Z

Managing Unprovisioned Computers in System Center 2012 Configuration Manager

I was recently asked about troubleshooting operating system deployments. One item in particular was around failures with unknown computers. An administrator was deploying Windows 7 to a group of devices but did not have the content replicated out to the distribution points. I pointed out that we had a rich content monitoring experience to ensure the content was available prior to deployment. =) Of course we know that things happen and there can be issues with operating system deployments. First thing first, we resolved the content issue. Now that is resolved we wanted to restart the deployment. Since the unknown computer started the process, by selecting the task sequence, it generated a temporary ‘unknown’ record. We need to go clear that record to restart the deployment. This type of record will exist for any failed unknown computer deployment.

By default the temporary unknown record is part of All Systems. Naturally we do not want to give the delete permissions so we can go create a custom collection and delegate permissions to correct operating system deployment administrator to manage this.

Before we begin, save the UnprovisionedComputers.Zip from the blog and extract it.

We are going to do three steps to do this:

Import a custom collection ‘Unprovisioned Computers’
Import a custom security role 'Computer Deletion Manager’
Associate the security role with the new collection

Import a custom collection:

Go to Assets and Compliance > Device Collections and select Import Collections
Browse to the UnprovisionedComputers.mof file (part of the downloaded ZIP file) and complete the wizard to import

Note: This links to All Systems so you need to have access to that collection to import.

To delete the record, an admin will need Collection Resource Delete permissions. You can add this to your current roles or you can import the custom role I have attached.

Create a custom security role:

Go to Administration > Security > Security Roles
Select Import Security Role from the ribbon
Browse to the Computer Deletion manager XML (part of the downloaded ZIP file), click OK.
You will now see a new custom role ‘Computer Deletion Manager’

Now we need to configure the administrator with the correct permissions

Associate the administrator with correct roles and permissions:

If you have not already done so, Add the user or group to the Administrative users
Administration > Security > Administrative Users > Add User or Group
Select the user or group and assign them the Operating System Deployment Manager role and Computer Deletion Manager
Go to the properties of the user and select the ‘Security Scopes’ tab
Select the radio button ‘Associate assigned security roles with specific security scopes and collections’
Select the Computer Deletion Manager role and click Edit
Ensure you only have Unprovisioned Computers and a default scope. This can be your scope for OSD objects (or you can make a scope that is not assigned to anything). Click OK.
Select the Operating System Deployment Manager role and click Edit
Add the appropriate collections and scopes. At this point add any collection you want to give the administrator permissions to deploy. Click OK.

Note: the collection you assign cannot be edited, only collections limited by it. This is in order for an admin not to be able to change their own scope. So if you want the admin to change rules directly on the OSD collection make sure to assign them a higher level collection that the OSD collection is limited by.
Click OK to save

Now that we have done this, we will have allowed an administrator to delete only the objects that are in an unprovisioned state. This can be done from the devices node under Assets and Compliance. This will restrict an admin from deleting managed clients.

Additionally, if you want to have a nice view to see the devices in this state, you can import the query attached to the blog. This will list all the devices, their MAC address and SMBIOS IDs.

Create an unprovisioned computers query:

Go to Monitoring > Queries and select Import Objects
Browse to the AllUnprovisionedComputersQuery.mof (part of the downloaded ZIP file) and complete the wizard to import

Thanks to Steven Gao with assistance in the blog.

John Vintzel
Microsoft Corporation| Sr. Program Manager | System Center Configuration Manager | twitter: jvintzel
http://blogs.technet.com/b/inside_osd

This posting is provided "AS IS" with no warranties, and confers no rights.

Custom Role Based Administration for Importing Computers

2012-04-30T13:41:00Z

Custom Role Based Administration for Importing Computers

In System Center 2012 Configuration Manger we have several roles that we ship with the product. By default we offer a general ‘Operating System Deployment Manager’. This is a fairly broad role that has a lot of access. The ‘Operating System Deployment Manager’ role combined with the access to All Systems, required to allow for computer import, may be too open for some environments. Below are some simple steps to make a role specific for just importing computers. This will allow additional scoping and help prevent an administrator from accidently deploying to All Systems.

First off, we need to create a custom security role and a restricted scope:

Create an XML with the text at the bottom of the blog.
Go to Administration > Security > Security Roles
Select Import Security Role from the ribbon
Browse to the XML, click OK.
You will now see a new custom role ‘Computer Import Manager’

Now we need to setup a user:

If you have not already done so, Add the user or group to the Administrative users

Administration > Security > Administrative Users > Add User or Group
Select the user or group and assign them the Operating System Deployment Manager role and Computer Import Manager

Go to the properties of the user and select the ‘Security Scopes’ tab
Select the radio button ‘Associate assigned security roles with specific security scopes and collections’
Select the Computer Import Manager role and click Edit
Ensure you only have All Systems and a default scope. This can be your scope for OSD objects (or you can make a scope that is not assigned to anything). Click OK.
Select the Operating System Deployment Manager role and click Edit
Add the appropriate collections and scopes. At this point you will not need All Systems, maybe just a desktops collection and unknown computers. Any collection you want to give the administrator permissions to deploy. Click OK.

Note: the collection you assign cannot be edited, only collections limited by it. This is in order for an admin not to be able to change their own scope. So if you want the admin to change rules directly on the OSD collection make sure to assign them a higher level collection that the OSD collection is limited by.
Click OK to save

If anyone is logged in, remember to close and reopen the console to ensure the permissions are correct.

Now you are done. If you assign the roles and scopes to an admin as described here, you end up with a user who can:

Import computers
View the properties and rules of any collection
Modify any device – install a client, approve and block, etc.
Deploy new software ONLY to the OSD collection

The admin will not be able to deploy to All Systems like the built-in role, so this is a more locked down approach.

Copy the information in red into a new XML file.

<SMS_Roles>
<SMS_Role CopiedFromID="SMS00001" RoleName="Import Computer Role" RoleDescription="Add this role to an administrative user. Associate this security role specifically with All Systems.">
<Operations>
<Operation GrantedOperations="129" ObjectTypeID="1" />
<Operation GrantedOperations="524289" ObjectTypeID="6" />
</Operations>
</SMS_Role>
</SMS_Roles>

Thanks to Maayan Bar-Niv for contributing to the post.

John Vintzel
Microsoft Corporation| Sr. Program Manager | System Center Configuration Manager | twitter: jvintzel

This posting is provided "AS IS" with no warranties, and confers no rights.

System Center 2012 Configuration Manager and Endpoint Protection (plus OSD)

2012-04-14T01:43:00Z

All,

Here are some great blogs from a fellow Program Manager Jason Githens (@jrg98108):

Launching a Windows Defender Offline Scan with Configuration Manager 2012 OSD

Operating System Deployment and Endpoint Protection Client Installation

Software Update Content Cleanup in System Center 2012 Configuration Manager

Building Custom Endpoint Protection Reports in System Center 2012 Configuration Manager

Managing Software Updates in Configuration Manager 2012

Enjoy!!

Note: In the first post you can see a great use of the updated task sequence export feature. Good work Jason!!

John Vintzel
Microsoft Corporation| Sr. Program Manager | System Center Configuration Manager | twitter: jvintzel
http://blogs.technet.com/b/inside_osd

This posting is provided "AS IS" with no warranties, and confers no rights.

Updated: Microsoft Management Summit 2012 Information

2012-03-05T15:00:00Z

Here is the early list of some of the must see sessions being presented on Configuration Manager 2012 by the Configuration Manager product team, including myself. Not to mention the dozens of Hands-on Labs presented by Wally Mead and other ConfigMgr team members.

CD-B102 State of the Union (Bill Anderson, Deb McFadden)
Tuesday, April 17 10:15 AM - 11:30 AM
CD-B330 Configuration Manager 2012: Overview (Russ Wilson, Bryan Keller)
Monday, April 16 3:00 PM - 4:15 PM
CD-B327 Configuration Manager 2012: Deployment and Infrastructure (Bryan Keller, D.C. Tardy)
Tuesday, April 17 11:45 AM - 1:00 PM
CD-B311 Configuration Manager 2012: Application Management Technical Overview (Bill Anderson, Mahyar Ghadiali)
Tuesday, April 17 2:15 PM - 3:30 PM
CD-B409 Configuration Manager 2012: Application Management Advanced Topics and Troubleshooting (Bill Anderson, Mahyar Ghadiali)
Tuesday, April 17 4:00 PM - 5:15 PM
CD-B315 Configuration Manager 2012: Plan, Deploy, and Migrate from Configuration Manager 2007 (Eric Orman, D.C. Tardy)
Wednesday, April 18 10:15 AM - 11:30 AM
CD-B329 Configuration Manager 2012: Operating System Deployment Technical Overview (John Vintzel)
Wednesday April 18th - 10:15 AM - 11:30 AM
CD-B332 Endpoint Protection 2012: Overview (Jason Githens, Mark Florida, Adwait Joshi)
Wednesday, April 18 11:45 AM - 1:00 PM
CD-B411 Configuration Manager 2012: Infrastructure Advanced Topics and Troubleshooting (D.C. Tardy)
Wednesday, April 18 2:15 PM - 3:30 PM
CD-B331 Configuration Manager 2012: Security And Compliance Management (Jason Githens, Onur Koc)
Thursday, April 19 10:15 AM - 11:30 AM
CD-B316 Day-to-Day Client and Security Management on Configuration Manager 2012 (Jason Tang)
Thursday, April 19 2:30 PM - 3:45 PM
Instructor Led Lab: Deploying Windows 7 to Bare Metal Systems with Configuration Manager 2012 (John Vintzel)
Friiday April 20th - 8:30 AM - 9:45 AM

I will also be at the ConfigMgr expo booth Monday evening.

John Vintzel
Microsoft Corporation| Sr. Program Manager | System Center Configuration Manager | twitter: jvintzel
http://blogs.technet.com/b/inside_osd

Configuration Manager 2012: Task Sequence Export and Import

2012-01-19T14:30:00Z

Export and Import – Version 2!

As we looking at Configuration Manager 2012 Release Candidate 2, I would like to go over a new feature that was introduced. Starting with ConfigMgr 2012 RC2, we have updated the import and export experiences around task sequences. If you are familiar with ConfigMgr 2007, you already know we have a way to import and export a task sequence which preserves the steps implemented for an operating system deployment. What was lacking from the existing import and export was to go beyond the metadata of the task sequence and preserve the administrator intent. Starting in ConfigMgr 2012 RC2, the existing import and export functionality has been replaced with an updated version that allows for not only the export of the task sequence, but an export and import of the related objects for the task sequence. If you used the Application import and export features in ConfigMgr 2012, it is a very similar experience.

So let’s go over some of the details….

From you Configuration Manager 2012 console, create a new operating system deployment task sequence. As part of your task sequence add a lot of different actions to see the relationship mappings in action. Make sure you add an Operating System Image, a Boot Image, a Client Agent package, a Driver Package and add some applications that have some dependencies.

Export:

Now select the task sequence and let’s walk you through the new export:

Select a task sequence or even multiple ones if you need to move several from one hierarchy to another. If you select more than one task sequence they are all stored in one export file.

Enter a location and name for the export. If you browse, we will append a .zip to the end of the file. If you type in a location, make sure the file ends in .zip.

On the initial screen you have a few options:

Export the task sequence with dependencies. This will scan for all the related objects. This will include the dependencies for applications.
- If you uncheck this checkbox, it will just take the task sequence without any dependencies. Similar to ConfigMgr 2007, but in a new format.
Export all content for selected task sequence and dependencies. This option will copy the content from the package source to the export location. On import it will use the import path as the new package source location.
- If you do not select this option, the location of the original package source will be retained at import.

The final output of the wizard will be a .zip file if there is no content or a .zip file and a folder named {export}_files (where {export} is the name of the .zip file) that contains the content required for the export. If you include content in your export, make sure you copy the .zip file and the {export}_files folder or your import will fail.

NOTE: If you want to use a different directory structure than the output of the export wizard. Export the task sequence without content. After import use the SDK to update the path to a new file server.

Import:

Now that you have exported your task sequence let’s walk through some of the features around import. When we import objects we retain some metadata about the original location that the export came from. This is a combination of package ID and site GUID for all objects except applications. For applications we have a proper GUID, so we retain the GUID so we know the application is unique. This is to help out with conflict resolution when objects are shared across multiple exports.

So let’s walk through the import:

On the first page, you browse to or type in the path to the zip file you previously exported.
The second page is the File Content page. It shows all the objects that will be imported. This is where we can see if items have been previously imported. On this page you will see a few actions. Select the action required for your import.

If the object has never been imported, there is an action to Create New.
If the object has been previously imported, we have two options:

1. Ignore Duplicate (default). This means it will not import the object, but it will link the already existing object to the task sequence.
2. Overwrite. This will overwrite the existing object with the one being imported. (For applications there is an add revision to update the existing application or create new to create new application instead of the adding a revision to the previously imported one).

You will now see a progress screen as we import the objects. Depending on the size of the import, this may take some time.

Upon completion, you will need to update any passwords as those are not carried forward to ensure security. Once you do that, you now have a functional task sequence that is ready to deploy!

Some additional notes:

When export and importing a boot image, both the export and import site need to have the same version of WinPE. If you update a site to WinPE 3.1, a export/import will fail with WinPE 3.0.
An application may not be detected as a duplicate even though it was previously imported. If the application was previously imported at Site 1 and the imported again at Site 2, it will be considered a new application. This is consistent with the Application Import wizard in the console. It is a best practice to import all objects at the CAS.
Passwords stored in the task sequence are not exported. When you edit the task sequence the password field will have a masked value. The value was not part of the export and is null. Ensure you update passwords for Domain Join, map network drive and Run command line actions.
References for disabled steps will not be exported. When a step is disabled the reference is not considered valid. As part of the export we will export all the data for the step, but not the reference package. An example is you have a Run Command Line action that references PKG00001, a "Scripts” package. When an export is performed, we will record all the information about the command line, timeout, etc but will not export the reference of PKG00001.
When importing a task sequence that has a reference to an Application; The application was imported and then an edit was made, the revision history on the application is incremented. If you reimport that application, it will detect a difference in the application and allow you to ignore it (link to the one you edited) or add a revision. If you add a revision it will change the metadata of the application to the metadata in the export file. If you accidently revise an app, you can go to revision history of the application and restore the revision. This is consistent with the Application Import wizard in the console.
On export of a task sequence if you reference the built-in task sequence package for the “Setup Windows and ConfigMgr” step, the package will not be exported. This is to ensure you are using the correct client version for the import hierarchy. If you created your own client agent package, the reference will be exported as it is seen as unique. On import of a task sequence, the package reference for the “Setup Windows and ConfigMgr” action will update the reference to the built-in ConfigMgr client agent package. Since over time there could be a difference in the client agent, this ensures you are deploying the correct agent version for your hierarchy. Best practice, use the built-in package.

Note, we also added export and import functionality to the packages node. It follows a similar work flow.

John Vintzel
Microsoft Corporation| Sr. Program Manager | System Center Configuration Manager | twitter: jvintzel
http://blogs.technet.com/b/inside_osd

The blog is own by some members of the System Center Configuration Manager product team. These postings are provided "AS IS" with no warranties, and confer no rights.

Download System Center Release Candidate here.

Configuration Manager 2012: User Device Affinity and OS Deployment

2011-06-20T13:00:00Z

As we move to Configuration Manager 2012 we have spent a lot of time focusing on user centric software distribution. One of the new concepts we have introduced is a concept called user device affinity (UDA). This provides the ability to define a relationship between a user and a device. It allows the admin to think “user first”, while also ensuring the application not installed everywhere the user logs on. Configuration Manager 2012 supports: single primary user to primary device, multiple primary devices per user, and multiple primary users per device.

Now when we look at operating system deployment we are still limited to machine targeting, however we can still prepare the system for user centric management. That is where the ability to set the UDA relationship is important.

So let’s look at how we can leverage our user centric software distribution and integrate it into our operating system deployment process.

Step 1. Create your task sequence. Configure task sequence similar to how you would in ConfigMgr 2007. Except in your ConfigMgr 2012 task sequence, let’s focus on only adding applications to your task sequence that require state restore. We will talk about how the rest of the applications get to the user shortly.

So after we have created a task sequence we are going to want to edit it. We are going to add a variable to the being of the task sequence SMSTSAssignUsersMode, this can have one of the following values:

Auto - the UDA will be processed during provisioning and automatically approved
Pending - the UDA will be processed during provisioning and await administrator approval
Disabled – does not allow UDA to be set during the task sequence

The purpose of this variable is to control on a task sequence level if you want to allow the ability to set UDA. The variable does not have to be set as part of the task sequence, it can be a computer variable, collection variable or set as part of the prestart command.

Step 2. Create a prestart command that you can prompt the end user to provide a user ID. This is the user ID that will be set in the relationship. The prestart command can be something simple like a VBScript with a input box to a fancy HTA that might provide some validation of the end user inputting the information. Basically an extensible solution, in case you might want to tie into a third party database or other resource to get the information.

The variable we want to set the information on is: SMSTSUdaUsers. This variable can contain one to many users. It needs to have the user in the following format Domain\User1, Domain\User2.

Below is a sample of code to set the UDA variable from a VBScript. From an input or other source, configure the script variable UDAUser and it will set the task sequence environment.

set env = CreateObject("Microsoft.SMS.TSEnvironment")
env("SMSTSUdaUsers") = UDAUser

Step 3. Now we have one more area to discuss. There is an option on both PXE and media to secure the entry point. The reason for this is that you may allow technicians to provision with auto approval on UDA and then set all PXE servers to pending, so you can approve the UDA a user may set. This option is easily set from a drop down box in the UI.

Illustrated below: (Setting on the PXE tab of a distribution point)

OK. We have set up our task sequence, created a prestart command to get some input from a user for setting UDA and set all the appropriate settings. What does this mean for the applications.

When deploying required applications to users, there is an option we like to call “pre-deploy”. This means that the users primary device will attempt to install the application that is targeted whether or no the use is logged in. When creating your user targeted, required deployment remember to enable the following checkbox in the deploy wizard.

Using these options will see your user targeted pre-deploy applications install immediately after the task sequence completed.

End to end workflow:

Using this approach to operating system to deployment will allow for quicker provisioning and simplified task sequences. In my next post, I will follow with more details on provisioning Applications in a task sequence. In additional some advantages to deploying applications to users outside of a task sequence.

John Vintzel
Microsoft Corporation| Sr. Program Manager | System Center Configuration Manager | twitter: jvintzel
http://blogs.technet.com/b/inside_osd

The blog is own by some members of the System Center Configuration Manager product team. These postings are provided "AS IS" with no warranties, and confer no rights.

Introduction to Configuration Manager 2012 - link
What’s New in Configuration Manager 2012 - link
Fundamentals of Configuration Manager 2012 - link
Download the ConfigMgr Beta 2 here
Join our 800 friends in the Community Evaluation Program here
Check out our Virtual Labs on Technet here
Download a pre configured Virtual Machine here

Configuration Manager 2012: Offline Servicing for Operating System Images

2011-04-18T08:00:00Z

In previous posts we have discussed changes to PXE and the Distribution Point, as well as new ways to manage and monitor content in your Configuration Manager environment. Now let’s discuss a feature to simply administration and reduce the total deployment time of your operating system images.

In Configuration Manager 2012 there is a new feature for applying updates to operating system images while they are in the Configuration Manager library. This means any operating system image you see in the Operating Systems > Operating Systems Images node from the Software Library wunderbar can be updated with Component Based Servicing (CBS) updates. By updating an image in the Software Library instead of performing a new build and capture of the operating system image you will gain a few distinct advantages. You will be able to reduce the risk of vulnerabilities during operating system deployments and reduce the overall operating system deployment to the end user. You will also reduce the administrative effort to maintain your operating system images.

The feature is applicable for Component Based Servicing (CBS) updates and for the following operating systems:

Microsoft Windows Vista SP2 and later
Microsoft Windows Server 2008 SP2 and later
Microsoft Windows 7 RTM
Microsoft Windows 2008 R2

*At the launch of ConfigMgr 2012 Beta 2 Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 are not supported. They will be supported with Configuration Manager 2012 RTM.

So let’s discuss how the feature works. As mentioned previously, offline servicing is available for CBS updates. This will work in coordination with the Configuration Manager Software Updates Point role.

Here are a couple steps to do before we start.

Configure the Software Update Point
Deploy updates to you Configuration Manager 2012 clients

Once the first two steps are completed, we can service operating system images in your Configuration Manager library.

From the Software Library Wonderbar, select Operating System > Operating System Images
Select an image you would like to update. This needs to meet the supported platforms listed above.
Select an image then click Schedule Updates from the ribbon. The Update Operating System Image wizard will appear. A list of updates will be presented. The list contains updates meeting the following criteria:
- The updates are CBS updates
- The updates have been deployed in your Configuration Manager environment. (This helps limit the selection of updates to those that have been deployed/tested in your enterprise).
- The updates have not successfully been deployed to your image file through the offline servicing feature
These updates are then filtered to match the architecture of the image file.

(Illustrated above; The schedule updates wizard presenting updates for a .wim file)
Select the updates you would like to apply to the image.
Next set a time for the servicing to occur. Servicing occurs on the site server, so you may want to schedule this off hours.

So now we have set our servicing schedule. Let’s go through the servicing process.

When the schedule time occurs for the updating the .wim file, the site server will wake ups.
The site server copies the .wim file from the package source and the appropriate updates from the content library to a temp folder.
The site server will mount the .wim file in the temp folder.
Through the use of DISM the selected updates are applied to the .wim file. The updates will be applied to all applicable images in the .wim file.
Upon success, the wim is restored to the package source location. The original copy of the .wim file preserved as a backup copy to help you easy revert if an update causes any issues. Configuration Manager only retains one back up copy. So the previous back up copy will be removed if it exists.
After the process is completed, the update status can be viewed from within the console. In the event of a failure, you will see which updates could not be successfully applied to the .wim file. Additionally, a historical view of the updates can be seen from the image property page.

(Illustrated above; A successful update to a .wim file in the ConfigMgr Software Library. Notice the Update Status tab showing the updates that were processed during the last task.)

(Illustrated above; properties page of an image in the Software Library. All updates that have been successfully installed can be viewed here.)
After the servicing is complete, you will need to still perform an “Update Distribution Point” action on the image. This will ensure the newly updated image is updated and available on assigned distribution points in your ConfigMgr infrastructure.

Troubleshooting Note: OfflineServicingMgr.log – New log introduced for the offline servicing feature.

That was the overview of our new feature for updating operating system images in the Software Library. We will continue the walk through of Configuration Manager 2012 next week.

John Vintzel
Microsoft Corporation| Sr. Program Manager | System Center Configuration Manager | twitter: jvintzel
http://blogs.technet.com/b/inside_osd

The blog is own by some members of the System Center Configuration Manager product team. These postings are provided "AS IS" with no warranties, and confer no rights.

Additional Configuration Manager 2012 Information:

Introduction to Configuration Manager 2012 - link
What’s New in Configuration Manager 2012 - link
Fundamentals of Configuration Manager 2012 - link

EDIT: Updated old references

Configuration Manager 2012: Content Prestaging and Remote Content Distribution

2011-04-11T08:00:00Z

A follow up to the blog on Distribution Points, we have many new features surrounding content distribution and distribution points. This post will walk through the end to end scenario of prestaging content on a distribution point. Today in configuration Manager 2007 we have a few different tools that allow for prestaging of content to sites and remote distributions. We have the ability to use Courier Sender, the Package preload on site tool and manual prestaging for Branch Distribution points. Each tool had its own limitations and no tool covered all the infrastructure components that needed to have content prestaged. Starting with Configuration Manager 2012 Beta 2, we have consolidated these items to one new tool and expanded the scope to work on all distribution points and site servers.

First let’s cover scheduling and throttling.

Scheduling and throttling: For a lot of administrators, prestaging content is not required, it is one way to deal with slow WAN links. In Configuration Manager 2007, administrators were forced to use a secondary site to get that functionality or used a Branch Distribution Point (which cannot co-exist with PXE). Now in Configuration Manager 2012 all remote distribution points have the ability to a schedule set or set specific throttling settings on a per distribution point level for when and how content distribution takes place. The controls used for scheduling and throttling are similar to what you would see on a Sender in Configuration Manager 2007 or 2012, but is actually used by a new component called Package Transfer Manager (PkgXferMgr). Package Transfer Manager is used to send the content from a site server (primary or secondary) to a remote distribution point. So if you are going Site to Distribution Point, don’t worry there is no need to trouble shoot senders.

Now assuming scheduling and throttling covers some, but not all of you needs, lets cover the rest of the prestage content feature. In Configuration Manager 2012, there is now a property on a distribution point to indicate that this distribution point is a prestaged distribution point. With this option, we are going to cover some new flexibility on how we can manage content in remote locations.

Package Distribution settings: Starting in Beta 2 for packages, drivers package, boot images and operating system installers and images we have a new new setting on the Distribution Settings tab on the package properties page. For Applications this is done on the Content property page on a deployment type. Click Distribution Settings from that tab (don’t worry, we will make this common on Applications post Beta 2). The setting is specific on how we want to content to interact with a distribution point we have indicated is a prestage distribution point. There are three new settings.

Automatically download content when packages are assigned to distribution points – This option is designed when you have smaller packages that the scheduling and throttling settings will be enough control for the distribution of content. An example for this is Silverlight or any other small content package

Download only content changes to the distribution point – This option is desgined when you initial package maybe large, but then future updates to the content in the package are generally smaller. A couple examples are Microsoft Office, the initial package may be 700 MB and that is too much to send over the network. However updates to this package might be something like a monthly security update and the 10 MB size is OK to distribute over the network. Driver Packages are another great example of this. Incremental additions of drivers might be small, but the initial package is large is size. (Not available for Applications in Beta 2, but will be available post Beta 2).

Manually copy the content in this package to the distribution point – This option is designed to never send the package to distribution point. This is designed for large file packages like an operating system image or when you just want to ensure that the network to the distribution point is not used for content distribution.

Remember, these settings are applicable per package and only affect distribution points with the setting Enable this distribution point for prestaged content. All other distribution points will receive content as usual.

We have now discussed how to setup a prestaged distribution and how to control the content being sent from the site server, now lets discuss how to actually prestage content on a distribution point.

Creating a Prestage Content File: To prestage a distribution point we need to create a file or files to use for distribution. Since the content on the Distribution Point is stored in the new content library we need to create a file that contains the content and some metadata about the content. From the Configuration Manager Administrator Console on the site sever (don’t worry, we will be more remote console friendly post Beta 2) let’s perform the following steps:

Navigate to the node in the Software Library that you want to create a prestage content file for. For this example, lets navigate to the Application Management > Applications Node

Select one to many Applications that you will want to prestage on your distribution points and select Create Prestage Content File from the home tab of the ribbon

Note:

For Applications: On the Home tab, in the Application group, expand Export, and then click Create Prestaged Content File.
For Packages: On the Home tab, in the <PackageName> group, click Create Prestaged Content File.

On the General page, click Browse, choose the location for the prestaged content file, specify a name for the file, and then click Save. You will use this prestaged content file on primary site servers, secondary site servers, or distribution points to import the content and metadata.

For applications, select Export all dependencies to add the dependencies associated with the application to the prestaged content file. This will allow us to detect all the dependencies currently associated with the Applications and add the to the Prestaged Content File. By default, this setting is selected.

In Administrator Comments, enter optional comments about the prestaged content file, and then click Next.

On the Content page, verify that the content listed is the content that you want to add to the prestaged content file, and then click Next.

The Progress page displays the content that is being added to the prestaged content file.

The Confirmation page displays whether or not the prestaged content file was created successfully

When successful, you have created a Prestage Content File that can be used to prestage content on your distribution point or site server.

So now we have created a Prestage Content File, what do we do with it. We will need to assign the content to the distribution point and extract the content to the file system on the distribution point. The Prestaged Content File we created can be moved around an infrastructure independent of Configuration Manager. We would want to copy this file to a USB drive or burn it to media, then send it to the location where the distribution point that needs to be prestaged is at. You will also need to copy the ExtractContent command-line utility from <Configuration Manager Source Folder>\Tools to the computer where you want to import the prestaged content file. You can add this to your USB or media or just copy it to the server.

Distributing and Extracting Prestaged Content: First step is to associate the content with the distribution point. We can do this by using the Distribute Content wizard. Select the packages you want to prestage and distribute to the Distribution Points or Distribution Point groups that will contain the Prestaged Distribution Point (There are more details on the Distribute Content Wizard in the Managing Content in Configuration Manager 2012 blog post). Doing this will associate the content with the distribution point, but will not return a content location request until it is prestaged (just make sure your distribution settings we talked about above are correct). If the content is set Download only content changes to the distribution point or Manually copy the content in this package to the distribution point the content can be viewed from the Monitoring workspace from the Distribution Status > Content Status node as in progress.

We already created the Prestaged Content File above and have send a USB drive containing the file to the remote site. The USB drive is connect to the remote distribution point and ready to prestage content. Perform the following steps to prestage content on the distribution point:

Open the Command Prompt with Adminsitrator Access on the local distribution point and navigate to the folder location of ExtractContent.

Type ExtractContent /P:<PrestagedFileLocation>\<PrestagedFileName> /S.

For example, type ExtractContent /P:D:\PrestagedFiles\MyPrestagedFile.pkgx /S where D:\PrestagedFiles\ is the PrestagedFileLocation, MyPrestagedFile.pkgx is the prestaged file name, and /S informs Configuration Manager to import only content files that are newer than what is currently on the distribution point.

After the ExtractContent tool has completed successfully it will send status back to the Configuration Manager 2012 site server. The site server will process the status message and register content availability. The content can be viewed from the Monitoring workspace from the Distribution Status > Content Status node as Success. Now your remote distribution point is prestaged and clients can download content from software installation.

References: Configuration Manager 2012 help file

John Vintzel
Microsoft Corporation| Sr. Program Manager | System Center Configuration Manager | twitter: jvintzel
http://blogs.technet.com/b/inside_osd

The blog is own by some members of the System Center Configuration Manager product team. These postings are provided "AS IS" with no warranties, and confer no rights.

Introduction to Configuration Manager 2012 - link
What’s New in Configuration Manager 2012 - link
Fundamentals of Configuration Manager 2012 - link

EDIT: Updated old references

Configuration Manager 2012: Content Monitoring and Validation

2011-04-06T08:00:00Z

In the last blog we covered Distribution Point Groups and the new ways to distribute and manage content. In this post we are going to cover monitoring the compliance of content and a new feature to validate content in the Configuration Manager 2012 infrastructure. After reading this blog, you will be able to see some new enhancements to Configuration Manager 2012 that will make troubleshooting content a lot easier (for both Software Distribution and Operating System Deployment).

Ok.. Here we go!

Monitoring

As I stated, in the last post we learned the basics of Distribution Point Groups and we learned the new ways to distribute and manage content through out the infrastructure. Now how can we see the status of the content distributions.

Distribution Status: In Configuration Manager we had a fairly simply way to view status of a package sent to distribution points, Package Status. It was attached to the content object and was not ideal if you needed to troubleshoot as distributions do not complete. Starting with Configuration Manager 2012 we have implemented advanced content monitoring. This new way to monitor the content in you infrastructure can be found in the Monitoring workspace within the Configuration Manager 2012 Admin Console. From the Monitoring workspace there is a node Distribution Status. This node contains three sub-nodes that offer three different ways to view distributions: Content Status, Distribution Point Group Status, Distribution Point Configuration Status.

Content Status offers a view of all the content objects that have been created in your Configuration Manager 2012 hierarchy. From the Content Status Node we can see the information about each package such as Name, Type (Boot image, Application, Driver package, etc..), number of distribution points targeted, Compliance Rate and more. This view gives us the critical view in to content readiness on the per object level. So if you wanted to see if your Windows 7 Enterprise image was successfully distributed to all the distribution points before deploying the task sequence. This gives you that view. Additionally, you can View status and get a view of the status of the content on a more granular level. In the detailed status we separate each state into its own tab to view (Success, In Progress Failed and Unknown). For each tab we can see all the available statuses for the state and the affected assets for each status. When you select a status, you can see all the assets affected, more detailed message information and the last time of the status.

(Illustration below: Content is distributed to two distribution points. The first picture is the Content Status node, giving us the quick view of all content in our environment. The second is a detailed view of our Windows 7 Enterprise distribution, so we can get a better view current status)

Distribution Point Group Status offers a view of distribution status to all the distribution point groups in your Configuration Manager 2012 hierarchy. From the Distribution Point Group Status node we can see the distribution point group name, description, member count, number of content objects assigned to the group for distribution. We can also see the overall group state and compliance rate of the content distributed to the group. Just like the Content Status node, we can View status for more detailed information. When we view status, we get the same tab view and status summarization as the Content Status node. One difference to this view is when we select a summarization you will see an entry for per Distribution Point per package. To explain the last sentence in detail, say your distribution point group contains two distribution points (Server 1 and Server 2) and two packages (Package 1 and Package 2). You distribute them to the distribution point group. Package 1 is successful to Server 1 and In Progress to Server 2, then Package 2 is In Progress to Server 1 and Server 2, when you look at the In Progress status, you will see three assets affects Server 2 > Package 1, Server 1 > Package 2, Server 2 > Package 2. This way if packages are failing for different reasons we can provide the detailed message. Sound like the information in this node can be overwhelming, don’t worry. You can select a column header in the Asset Details and group the by Assets or Package name.

(Illustration below: The detailed status view of content distributed to Group 1. In the asset details we have group the details by the Device. The grouping can be collapsed for easier viewing.)

Distribution Point Configuration Status offers a view of the configuration of a distribution point. This view is slightly different from the other two nodes. When we look at the overall status, we are looking at the status of the content in addition to optional components such as PXE and Multicast. Since this node is intended for more than just content status, we do not have the standard View Status the other two nodes have. From this node we have a easy access tab to view all the status messages associated with this distribution point.

(Illustration below: The Distribution Point Configuration Status node and the details tab selected showing the latest status messages of the distribution point.)

Validation

One of the biggest issues our administrators faced with Configuration Manager was not just getting the content on the Distribution Points, but knowing what is happening with the content on the distribution points. So let’s talk about another new feature in content distribution called Content Validation.

Content Validation: Content validation is a new feature to check the status of content that has already been distributed on a distribution point. Content can be validated in a two ways, so lets go over them. You may have noticed a button on the Content property page of a Distribution Point or Distribution Point Group. From this page an administrator can select a package and click the validate button. When this action is initiated the site server sends a command to the distribution point provider to validate the hash of the package on the distribution point. Once the action is completed the distribution point provider reports back to the site server and updates the compliance status in the Distribution Status node. This means if the hash comes back as not compliant on the distribution point you will see the status node change its compliance to reflect the invalid package. While we do not automatically remediate the invalid content on the distribution point, an administrator can redistribute the content to correct the error. We can also perform this same type of action from the Content Locations tab on a package.

Another way we offer to validate content is on a schedule per distribution point. When the schedule runs, it performs a hash of each package individually on the distribution point and reports the status to the site server. For each package hash that is determined as invalid, the compliance status will be reflected in the Distribution Status node from the Monitoring workspace. Setting the schedule can be done in two different ways. The first is during Distribution Point role setup. The second is from the Property page of the distribution point. On the property page there is a new tab called Content Validation. On this tab you can set up a schedule for the task to occur. A task can be set to run a customizable frequencies, like every Sunday at 2.00am. It also offers the ability to set the process priority. This will allow you to regulate the performance impact on your server. The validation task is run locally by the distribution point provider and uses the Windows Task scheduler.

One last thing, while Distribution Points are still tied to a site from a site system view, we can manage and distribute content throughout the infrastructure. Status cannot be view across primary sites, but overall from the Central administration site.

So this was a overview of our new monnitoring for content distribution and content validation features starting in Configuration Manager 2012 Beta 2. In the next blog, I will cover new ways to work with content on remote sites and the ability to prestage content on site servers and distribution points.

Here are some helpful links for more information:

Introduction to Configuration Manager 2012 - link
What’s New in Configuration Manager 2012 - link
Fundamentals of Configuration Manager 2012 - link

John Vintzel
Microsoft Corporation| Sr. Program Manager | System Center Configuration Manager | twitter: jvintzel
http://blogs.technet.com/b/inside_osd

The blog is own by some members of the System Center Configuration Manager product team. These postings are provided "AS IS" with no warranties, and confer no rights.

EDIT: Updated old references