Notes from my projects

My thoughts about MMS2013

2013-04-20T03:25:00Z

I was in Las Vegas on Microsoft Management Summit 2013 last week. I thought it would be beneficial for those who didn’t manage to get there to give you my thoughts about the conference through my experience. I also would like to highlight some sessions and events that I think are really interesting and worth to check for those who are working with MDOP suite products, Configuration Manager 2012 and MDT 2012 as well as doing desktop deployment projects.

Firstly, you need to check Keynote session “Cloud Optimize Your Business with Microsoft Management Solutions” that was delivered by Brad Anderson and was mostly around cloud solutions and our new Windows Server 2012 and System Center products.

Among all the sessions at the event, I chose to be on those that are about Configuration Manager 2012 and desktop deployment just because it is my primary technological focus. These are the sessions that I attended in person or watched later:

UD-B320 – Configuration Manager 2012: MVP Experts Panel. This session was presented by our Configuration Manager 2012 MVPs: Kent Agerlund, Johan Arwidmark, Sherry Kissinger, Brian Mason, Kim Oppalfens, Greg Ramsey, Steve Thompson and Jason Sandys. The beauty of this session was that these guys gave us real world examples of ConfigMgr 2012 “how-to” from their projects.
AI-B302 – Using Dynamic Access Control and Rights Management for Information Protection. Adam Hall and Brian Desmond explained and showed how dynamic access control works when you have File Server role installed on Windows Server 2012.
UD-B404 – Migration Best Practices from System Center Configuration Manager 2007-2012. Session was delivered by Laszlo Ruboczki who revealed most common circumstances and issues for migration projects.
DC-B303 – Advanced Microsoft Deployment Toolkit 2012 Update 1 Customizations. Mikael Nystrom and Johan Arwidmark talked about MDT 2012 Update 1 customizations, deployment scenarios, tips and tricks.
UD-B330 – System Center 2012 Configuration Manager SP1 and Windows Intune: Unified Modern Device Management. Jeffrey Sutherland and Martin Booth discussed and showed how to provision and manage devices via Windows Intune.
UD-B301 – Application Delivery with System Center 2012 Configuration Manager SP1 and Windows Intune. Dilip Radhakrishnan and Heidi Cheng showed how to deliver applications to different platforms and using different techniques.
UD-B344 – Becoming a Windows Intune IT Administrator: A Real-World Perspective. Session is not yet available, so please check later
DC-B320 – Windows Store Apps: Enterprise LOB App Deployment Scenarios. Mike Niehaus discussed and explained how to install and provision Modern UI applications.
UD-B406 – Truly Better Together: Configuration Manager 2012 SP1 and PowerShell. Kaido Järvemets and Greg Ramsey presented the beauty of PowerShell cmdlets for Configuration Manager 2012.
DC-B309 – Choosing the Right OS Deployment Tool. Mikael Nystrom and Johan Arwidmark delivered great session where they showed how to choose the right tool for OS tweaking and deployment.
UD-B342 – Configuration Manager 2012 and Orchestrator 2012. Microsoft PFE Steven Rachui showed how to use Orchestrator with CM12.
UD-B305 – How Microsoft IT Uses System Center Configuration Manager 2012 SP1. Microsoft IT guys Shitanshu Verma and Karthikeyan Jayavel clarified how MSIT manages our CM12 environment with some tips and tricks from day to day operational perspective.
UD-B308 – Advanced Infrastructure for System Center 2012 Configuration Manager SP1. This session was presented by Kent Agerlund and Brian Mason where they explained how to deploy high availability for CM12 and do performance optimization with focus at: offload SQL, fault tolerance, multi domain environment and workgroup clients.
UD-B313 – Documentation, Disaster Recovery, and Using Scripts as Time Savers. Michael Schorr pointed out how to script Configuration Manager installation and use the same files as part of building a test lab and recovering CM12 hierarchy.
DC-B301 – A Geek's Guide to USMT 5.0. Johan Arwidmark demonstrated how to use advanced techniques for migrating user files and settings using USMT 5.0.
DC-B311 – Windows Sysinternals Primer. Aaron Margosis presented new and updated tools from Sysinternals suite.
DC-B312 – What's New with Windows 8 Bitlocker and Microsoft BitLocker Administration and Management 2.0. Paul MacKnight and Lance Crandall discussed in details all the changes from MBAM 1.0 to 2.0 as well as made an announcement of MDOP 2013 GA.
DC-B319 – Windows RT in the Enterprise. Mike Niehaus was talking about challenges as well as known issues and limitations for Windows RT devices in the enterprise environment.
UD-B311 – Deploying System Center 2012 Configuration Manager SP1 With Windows Intune. Karthikeyan Jayavel and Arun Ramakrishnan offered Windows Intune solution deployed by Microsoft IT.
UD-B341 – Complex Maintenance Using System Center 2012 Configuration Manager and Orchestrator: Patching a Cluster. Microsoft PFE Neil Peterson showed his software update management solution for complex environments based on Configuration Manager 2012 and Orchestrator 2012.
DC-B318 – What's New in Windows 8 Deployment. Mike Niehaus presented session where he demonstrated all the new tools and technical aspects of Windows 8 deployment projects.
DC-B401 – Advanced Automation Using Windows Powershell. Kenneth Hansen and Steven Murawski showed what’s new in PowerShell 3.0 and how to do day to day work using scripts.
DC-B316 – Real World Windows 8 Deployment with MDT 2012 Update 1. Johan Arwidmark presented different aspects of Windows 8 deployment scenarios using MDT 2012 Update 1.
UD-B338 –Reporting in System Center 2012 Configuration Manager SP1. Saud Al-Mishari explained reporting functionality in Configuration Manager 2012 by deep diving into SQL Management Studio and showed how to use vex views for custom reports.
DC-B306 – Building the Perfect Windows 8 Image. Mikael Nystrom and Johan Arwidmark were discussing different aspects of image creation, like when to use thin, hybrid or thick image as well as what tools can be used for custom image creation.

At the end of every day, there was a socializing event named “Solutions Expo and Microsoft Pavilion”. In a huge room more than 80 partner organizations had their stands where conference participants actively discussed partners’ solutions and how to use Microsoft products. I personally had many chats and discussions with Microsoft guys as well as partner organizations’ representatives. I also found that VMware sold Shavlik Technologies to LANDesk. It is an interesting turn in IT market.

You can find all recordings of MMS2013 session here: http://channel9.msdn.com/Events/MMS/2013. And if you need to download them all (be prepared to get more than 30Gb of traffic :-) ), you can use a set of PowerShell scripts described here.

Overall I can say that the MMS2013 conference was really interesting and packed with events and good talks with MVPs, Microsoft guys as well as customers’ technical folks. I do recommend to spare some time and check videos.

SCCM 2007. Distribution of application package with huge folder structure took too long on BITS enabled DP

2013-02-04T15:52:00Z

During my previous project I run into problem when tried to distribute Adobe Acrobat Pro 9.3.4 package from BITS enabled DP to Windows 7 x86 client computer and it took up to 10 hours. It was SCCM 2007 infra. Package itself contains 1017 folders and 12552 files and 1.6 GB size. I tried different ideas to solve this issue and eventually I found in MSFT knowledge database similar case but with IIS 7.0. My environment was built on Windows Server 2008 R2 with IIS 7.5 so ideas from this case didn’t work at all. I took only one solution from the case which decreases overall distribution time from 10 hours up to 3 hours but anyway it wasn’t acceptable by customer. Customer also opened case with PSS and they confirmed that there is a bug in the IIS 7.0 and IIS 7.5 and you need to do following:

1. For IIS 7.0 you should apply KB957001 and this KB is already included to IIS 7.5

2. You need to configure ‘maxAllowedXmlRequestLength’ attribute which specifies the maximum length, in bytes, of the request XML body for WebDAV requests. By default it’s 1000000 byte. Additional info you can find here

You can do this by running appcmd.exe command and set max length to 2Mb:

appcmd.exe set config "Default Web Site" -section:system.webServer/webdav/authoring /maxAllowedXmlRequestLength:2097152 /commit:apphost

To check that settings are applied successfully you can run following command:

appcmd list config "Site_Name_Here" -section:system.webServer/webdav/authoring

Note that this is size of XML response size and not number of files or the size of files.

As I mentioned earlier it didn’t help too much but for someone it could be good solution.

I solved this problem by wrapped up all files and folders to one EXE file with total size of 600Mb and as result decrease distribution time from 3 hours to 5 min :-)

Change default logon domain name in the Windows 7 logon screen

2013-01-30T15:49:00Z

This technical solution is not connected to the SCCM 2007 which is my focus technologies but anyway I want to share it here. I have following customer environment:

Windows 7 computers joined to domain A in the city A and we have users in same domain as well
We have users in the city B with domain B and they use Windows 7 computers joined to domain A
There is a two-way, transitive trust relationship between domain A and domain B

Everything was OK until users from domain B told me that they want to login to Windows 7 computers (joined to domain A) without typing domainB\username. I didn’t have solution off the top of my head and I made quick Technet search which gave me this article http://support.microsoft.com/kb/555050. Unfortunately this solution didn’t work as is on Windows 7 OS. First rational idea was to use domain GPO to set DefaultLogonDomain parameter but we use only one domain GPO for Windows 7 computers and create new one for users from domain B wasn’t fancy option.

Solution was come from an idea to trace registry settings after I applied local GPO with DefaultLogonDomain parameter and as result I put this REG file as a task to deployment SCCM task sequence.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]

“DefaultLogonDomain”=”DOMAINB”

Remote Tools don’t work in Windows 7 x64 client

2013-01-28T03:43:56Z

On one of my projects I found weird thing when SCCM Remote Tools work without any problem on Windows 7 x32 client but failed to run or ask me about local admin credentials to connect to Windows x64 client.

I fixed this by changing permissions for RCLaunch.exe file. I granted Read/Execute permissions for “ConfigMgr Remote Control Users” group to the file located in Windows 7 x64 OS \Windows\SysWOW64\CCM\clicomp\RemCtrl\RCLaunch.exe.

After that Remote Tolls started to work fine.

Run “Add a printer” wizard with administrative credentials

2011-10-21T03:33:00Z

I have a question from customer about how to add local printer to Windows 7 Enterprise if you have a CD with printer drivers but don’t have a local administrator credentials. Well, it is easy if you have SCCM infrastructure and SCCM client installed on your target computers.

During one of my project we introduced application self-service solution to end users. We just used GPO preferences and placed “Run Advertised Programs” shortcut to user’s desktop and renamed it to “My Installable Applications”. It is pretty neat and most of customer’s SCCM packages were created as an optional (not mandatory) for end users. So end users could install any of available apps from a list of available apps.

Coming back to initial question about local printer I found that it could be done via SCCM package. I put following command line to package and distributed it to end user computers with administrative rights:

rundll32 printui.dll,PrintUIEntry /il

End users can choose it from a list of available apps. Done deal!

FIXED: Problem with FEP 2010 alerts

2011-10-12T16:08:17Z

I have had a scenario with pretty simple FEP 2010 with Update Rollup 1 configuration: basic topology with remote reporting server. In this scenario I had two servers: one primary site server and another reporting server with SRSS on board.

Symptom

After FEP server components installation everything works fine except alerts. I have tried to send test email using Windows Integrated or Anonymous authentication but had zero success results. Nothing was wrong on a first sight with primary site server, its firewall or destination email server. I checked email server by spoofing it via telnet and have test email arrived to my Inbox. (For those who curious how to do it you can find step by step instruction here http://support.microsoft.com/kb/153119). So nothing was wrong with email server or port on firewall. I have checked FEP event log and found nothing there connected to test email as well. I have had no choice so I called Microsoft Premier Support and ask them to help me. CritSit A was opened because this scenario was happened on customer FEP brand new installation and customer has intention to start production deployment of FEP clients in couple of days.

Resolution

PSS guys asked me to change FEP event trace logging mode to Verbose. I stopped trace (trace file was cleaned). Started trace again and restarted Forefront Endpoint Protection Monitoring Service (FepSrv.exe) and tried to send test alert email again. After that I stopped FEP event trace and gave result file to PSS guys for further investigation. They came back to me with question about microsoft.configurationmanagement.managementprovider.dll file located in “C:\Program Files (x86)\Microsoft Configuration Manager\AdminUI\bin” folder. They told me FEP monitoring service couldn’t use it and asked me to check it. This is what I done:

I compared ACL of this folder with similar installation on my LAB and found that customer’s folder doesn’t have local group “Users” with read and execute permissions. I fixed it.
I run command – tasklist /m "microsoft.configurationmanagement.managementprovider.dll” and found an error in the output.
I checked DLL name and found that it was updated during SCCM KB2271736 update http://support.microsoft.com/KB/2271736. I replace it with original DLL from KB.
Run tasklist command again and found same error. I rebooted server. Run tasklist command again after reboot and received response that FepSrv.exe is using this DLL.
After that I run SCCM console with FEP dashboard installed and run test alert. I have received result in the Forefront event log and test email in my Inbox.

Case closed

BUILD conference is online

2011-09-13T18:41:22Z

Everyone who wants to know latest news about Windows 8 should go to http://www.buildwindows.com/ and watch Windows Division President Steven Sinofsky’s keynote live or on demand anytime.

And according to http://blogs.msdn.com/b/b8/archive/2011/09/13/welcome-to-windows-8-the-developer-preview.aspx blog Windows 8 Developer Preview will be available for test! Excellent news!

How to disable "Automatically detect settings" in IE8

2011-08-17T21:47:00Z

I have been asked today to help with Internet Explorer 8 settings management. My standard answer “most of the IE settings could be managed via GPO” didn’t work on 100% because there are no settings in GPO to enable/disable “Automatically detect settings”. [Correction] This particular setting could be found in the Internet Explorer Maintenance folder of User Settings GPO but this article is mostly about how to find quick solution using Process Monitor tool. Thanks to Simon to point this out.

When I see such a challenge I always use Mark’s tool Process Monitor which helped me this time as well. I run procmon.exe and in IE8 I went to Internet Options -> Connections -> LAN settings -> and uncheck “Automatically detect settings”. Click “Capture” in Process Monitor app, came back to IE and hit OK on all opened windows. Close IE and run back to Process Monitor and stop event capturing.

Quick review of results gave me target registry key:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]

"DefaultConnectionSettings"=hex:46,00,00,00,07,00,00,00,01,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,90,b6,c6,d7,21,5d,cc,01,\

00,00,00,00,00,00,00,00,00,00,00,00,06,00,00,00,17,00,00,00,00,00,00,00,fe,\

80,00,00,00,00,00,00,b4,b8,7a,8d,90,e7,17,bc,0c,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,ff,ff,ff,ff,ff,ff,ff,ff,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,17,00,00,00,00,00,\

00,00,fe,80,00,00,00,00,00,00,41,e6,7c,8b,91,87,d9,02,0f,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,17,00,00,\

00,00,00,00,00,fe,80,00,00,00,00,00,00,ed,2c,74,3e,d7,32,18,63,10,00,00,00,\

00,00,00,00,57,b8,3e,70,00,00,00,80,4c,00,31,00,00,00,00,00,e6,3e,60,00,10,\

20,4d,49,43,52,4f,53,7e,31,00,00,40,00,08,00,04,00,ef,be,fc,3c,f0,9d,e6,3e,\

60,00,2a,00,00,00,21,29,00,00,00,00,02,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,00,00,18,00,\

02,00,00,00,0a,45,0e,9e,00,00,00,00,00,00,00,00,6e,64,6f,77,73,00,3c,00,08,\

00,04,00,ef,be,fc,3c,f0,9d,75,3e,94,8d,2a,00,00,00,22,29,00,00,00,00,02,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,57,00,69,00,6e,00,64,00,6f,00,77,\

00,73,00,00,00,16,00,6c,00,b1,00,00,00,00,00,fc,3c,dc,a0,16,20,48,69,73,74,\

6f,72,79,00,3c,00,08,00,04,00,ef,be,fc,3c,f0,9d,fc,3c,dc,a0,2a,00,00,00,24,\

29,00,00,02,00,00,00,c0,a8,dc,01,00,00,00,00,00,00,00,00,00,00,48,00,69,00,\

73,00,74,00,6f,00,72,00,79,00,00,00,16,00,1a,00,00,00,03,00,ef,be,60,35,39,\

ff,a7,c2,cf,11,bf,f4,44,45,53,54,00,00,16,00,00,00,00,00,00,00,00,00,00,00,\

72,b8,3e,70,00,00,00,80,71,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,02,00,00,00,c0,a8,5e,01,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00

MED-V 2.0 Workspace doesn’t start after FTS

2011-07-29T19:07:49Z

I have found strange situation when after FTS (first time setup) process I see following picture all the time:

and virtual machine didn’t start and was running in kind of loop.

First thing which I didn’t like was message “Recommended updates for Integration Components available” but I was 100% sure that I installed them during Windows XP image creation. Further investigation showed that Integration Components inside not syspreped Windows XP have the following version:

I logged in to the MED-V Workspace in full screen, uninstalled Integration Components, rebooted VPC, installed new, rebooted VPC and as result I have had new version:

When I run Workspace again VPC start window looked different:

and MED-V Workspace loaded without delays.

I got new Integration Components bits from Workspace, packaged them and pushed via SCCM as an update to already deployed MED-V computers.

MED-V Host Agent installation error 1935 on Windows 7 x86

2011-07-26T23:52:00Z

Today I found pretty weird situation when already tested installation package with MED-V components inside was failed during MED-V Host Agent installation.

Command line for agent installation was:

MED-V_HostAgent_Setup.exe IGNORE_PREREQUISITES=1 /l* %TEMP%\MEDVHost.log

And as result I have received following error message:

Error 1935. An error occurred during the installation of assembly 'Microsoft.Medv,version="2.0.414.0",culture="neutral",publicKeyToken="31BF3856AD364E35",

processorArchitecture="MSIL"'. Please refer to Help and Support for more information. HRESULT: 0x8002802F. assembly interface: , function:

CreateAssemblyNameObject, component: {664A25BC-F47F-452C-905E-6905005115B2}

And next error:

MSI (s) (80:90) [17:04:22:277]: Product: MED-V Host Agent -- Error 1935. An error occurred during the installation of assembly 'Microsoft.Medv,version="2.0.414.0",

culture="neutral",publicKeyToken="31BF3856AD364E35",processorArchitecture="MSIL"'. Please refer to Help and Support for more information. HRESULT: 0x8002802F.

assembly interface: , function: CreateAssemblyNameObject, component: {664A25BC-F47F-452C-905E-6905005115B2}

What I found when I deleted “Microsoft .NET Framework 4 Client Profile” from Add/Remove Programs and rebooted computer that MED-V Host Agent installation went without any errors.