System Center Premier Field Engineer Blog

I lost my primary site in my hierarchy, what I do now?

Santos Martinez — Fri, 17 May 2013 02:47:13 GMT

I few weeks ago this happened to one of you, I know the frustration that this may have caused when you initially saw it. Either the server files where corrupted or the vhd was lost on a power lost, what happened now you are on a panic state. You need...(read more)

Wanna work with me Wednesday

Santos Martinez — Wed, 08 May 2013 15:49:55 GMT

Do you want to work for Microsoft? Are you ready for the challenge, well we have some interesting interviews on the Wanna Work with me Wednesday blog. I had the pleasure to be selected for todays post of “Wanna work with me”, hope you guys like it. http...(read more)

UD-B324 SQL Server 2012 for System Center Administrators Available Online

Santos Martinez — Wed, 17 Apr 2013 02:24:57 GMT

Hello all, ConfigNinja here. It was a pleasure for me to deliver this session at MMS 2013, its never easy to be the first session of the event. A lot of icebreakers and hard rehearsal on the same day, but was happy to be there and see many friend, customers...(read more)

CU1 for SysCtr 2012 ConfigMgr SP1–Installation and More.

Santos Martinez — Mon, 25 Mar 2013 09:47:00 GMT

Hello there, if you missed my tweet post on Friday about the new Cumulative Update 1 for System Center 2012 Configuration Manager Sp1, here is a quick link and recap on it. After the hotfix information, I capture some of the screenshots of this fix on...(read more)

Nostalgia: March 22, 1984 Microsoft Press introduces its first two books

Santos Martinez — Sat, 23 Mar 2013 01:17:59 GMT

I got this in my inbox today, tough it was worth sharing. I know its hard to take the first step in writing a book, its also hard to be the first one in being published by a company. I can’t imagine what this authors tough when MS Press accept their book...(read more)

SQL Server for ConfigMgr 2012, eBook and Top 10 Database Issues.

Santos Martinez — Wed, 06 Mar 2013 19:30:00 GMT

This past week I have the opportunity to speak to my peers about this topic, while speaking of it I tough my self that I will share some of these key values with my blog readers. I know how important this content can be for them, so lets sharp some extra...(read more)

Stay Healthy be proactive with RaaS for ConfigMgr

Santos Martinez — Wed, 06 Feb 2013 23:53:39 GMT

Today I want to write about Rap as a Service, the newest offering from Microsoft Premier Support! In the past few months we have convert our Configuration Manager Risk Assessment Program into RaaS for CM, here are more details about what we you can do...(read more)

Security Compliance Manager 3.0 now available for download!

Santos Martinez — Wed, 30 Jan 2013 02:31:46 GMT

Secure your environment with SCM 3.0! The Security Compliance Manager (SCM) is a free tool from the Microsoft Solution Accelerators team that enables you to quickly configure and manage the computers in your environment and your private cloud using Group...(read more)

Install SysCtr 2012 ConfigMgr in Windows Server 2012 and SQL Server 2012 My Notes

Santos Martinez — Fri, 25 Jan 2013 05:16:27 GMT

Installing System Center 2012 Configuration Manager in Windows Server 2012 and SQL Server 2012 My Notes This week I took the task to build a System Center 2012 Configuration Manager SP1 in Windows Server 2012 and SQL Server 2012, I will outline some of...(read more)

Updated System Center 2012 Configuration Manager Antivirus Exclusions with more details on OSD and Boot Images, etc...

Clifton Hughes_MS — Fri, 11 Jan 2013 18:35:00 GMT

With the release of Service Pack 1 for System Center 2012 Configuration Manager, we have been seeing some issues (not necessarily new issues) revealed with Antivirus Exclusion issues around OSD and Boot Image related activities as follows:

OSD Related A/V Exclusion Considerations:

Boot image actions:

Importing default boot WIM’s during initial site setup
Updating default boot WIM’s during site upgrade
Manual import of custom boot images (customer action)
Customize boot images (drivers, prestart command, WinPE optional components, background
image, etc.)

Folders to exclude from AV scanning:

Temporary folder for these cases is C:\Windows\TEMP\BootImages\{GUID}. Exclude C:\Windows\TEMP\BootImages
and subfolders.

OS image actions:

Offline Servicing

Folders to exclude from AV scanning:

Temporary folder for offline servicing is <X:>\ConfigMgr_OfflineImageServicing
and several subfolders used for different purposes – staging files, mounting
OS, etc. – where <X:> is the StagingDrive value from the Offline
Servicing Manager section of the site control file. If this value is
missing, we use the drive where the site is installed. Exclude <X:>\ConfigMgr_OfflineImageServicing
and subfolders.\

Boot images not updated after upgrading to SP1 in System Center 2012 Configuration Manager:

I was also provided anecdotal information from an issue that if you find yourself in situation where boot images didn’t get updated during site upgrade to SP1, you
can manually update the boot images using the following instructions:

Rename the boot.wim and the default boot wims in each architecture folder of the <smsinstall>OSD\boot\ folder – both the i386 and x64 to <wim>.bak
Starting with the i386 folder first...Find the install folder of the ADK, which should be here if you installed with the defaults: “C:\Program Files (x86)\Windows
Kits\8.0\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\en-us\winpe.wim”. You will need to copy the winpe.wim to the <smsinstall>OSD\boot\i386 folder. Rename it to boot.wim.
You will also need to copy it again, but this time rename it so it matches the name of the default boot wim for the site – so it should look like boot.<packageid>.wim
Update default boot image. Click “Execute Method” -> input object path as SMS_BootImagePackage.PackageID="<Image ID you see in the Console e.g. POL00001>" -> UpdateDefaultImage
You will need to do this for the x64 folder as well. Do not do this for any custom boot images – this is just to update the default boot wims installed during setup of the site.

General Antivirus Exclusions and Additional Information for System Center 2012 Configuration Manager Endpoint Protection

Additionally per my other post showing how to import various templates for different servers, here is the general list of file/folder exclusions exported from the Endpoint Protection System Center 2012 Configuration Manager template"

%allusersprofile%\NTUser.pol
%systemroot%\system32\GroupPolicy\registry.pol
%windir%\Security\database\*.chk
%windir%\Security\database\*.edb
%windir%\Security\database\*.jrs
%windir%\Security\database\*.log
%windir%\Security\database\*.sdb
%windir%\SoftwareDistribution\Datastore\Datastore.edb
%windir%\SoftwareDistribution\Datastore\Logs\edb.chk
%windir%\SoftwareDistribution\Datastore\Logs\edb*.log
%windir%\SoftwareDistribution\Datastore\Logs\Edbres00001.jrs
%windir%\SoftwareDistribution\Datastore\Logs\Edbres00002.jrs
%windir%\SoftwareDistribution\Datastore\Logs\Res1.log
%windir%\SoftwareDistribution\Datastore\Logs\Res2.log
%windir%\SoftwareDistribution\Datastore\Logs\tmp.edb
%programfiles%\Microsoft Configuration Manager\Inboxes\*.* (shortened list for blog sake)
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\*.* (shortened list for blog sake)

These entries above were taken directly from one of the included templates in System Center 2012 Configuration Manager which I have attached to the post

Additional links to Antivirus and Antimalware Information:

Where is the Documentation for System Center 2012 Endpoint Protection?

Forefront Endpoint Protection Blog

Guidance on serve initial FEP definition update with SCCM through DP

How to use the Definition Update Automation Tool for Forefront Endpoint Protection
2010 Update Rollup 1

Important Changes to Forefront Product Roadmaps

Support Questions about Windows 8 and Windows Server 2012 for Configuration Manager and
Endpoint Protection

Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows
http://support.microsoft.com/kb/822158

Antivirus programs may contribute to file backlogs in SMS 2.0, SMS 2003 and Configuration Manager 2007:
http://support.microsoft.com/kb/327453

ConfigMgr 2007 Antivirus Scan and Exclusion Recommendations:
http://blogs.technet.com/b/configurationmgr/archive/2010/11/30/configmgr-2007-antivirus-scan-and-exclusion-recommendations.aspx

Thanks, Cliff Hughes
Premier Field Engineer
System Center 2012 Configuration Manager