Carlos Santiago's Manageability Blog - SCCM/Softgrid : SCCM

Configuration Manager 2007 and SMS 2003 Support Statements

carloss — Mon, 15 Jun 2009 04:21:51 GMT

SQL Server 2008 Service Pack 1 is now supported on Configuration Manager 2007 (SP1 and/or R2)

System Center Configuration Manager 2007 SP1 and/or R2 now supports the use of SQL Server 2008 SP1.

No hofixes are required.

Windows Vista and Windows Server 2008 Service Pack 2 are now supported on Systems Management Server 2003 SP3

Systems Management Server 2003 SP3 now supports Windows Vista and Windows Server 2008 SP2 as clients. Administrator consoles or site server roles will not be supported on these platforms.

No hotfixes are required.

Windows Vista and Windows Server 2008 Service Pack 2 are now supported on Configuration Manager 2007 RTM

System Center Configuration 2007 SP1 now supports Windows Vista and Windows Server 2008 SP2 as clients. Administrator consoles or site server roles will not be supported on these platforms.

The following hotfixes are required:

· KB969991- When you use System Center Configuration Manager 2007 RTM to capture an image of Windows Vista SP2 or of Windows Server 2008 SP2, the image capture process fails during the "Prepare Windows for Capture" stage

Windows Vista and Windows Server 2003 Service Pack 2 are now supported on Configuration Manager 2007 SP1

System Center Configuration 2007 SP1 now supports Windows Vista and Windows Server 2008 SP2 as clients, for administrator console installations, and Windows Server 2008 SP2 for site-server roles.

The following hotfixes are required:

· KB970093- When you use System Center Configuration Manager 2007 Service Pack 1 to capture an image of Windows Vista SP2 or of Windows Server 2008 SP2, the image capture process fails during the "Prepare Windows for Capture" stage

How To Check If A BITS Enabled Distribution Point Is Up And Running

carloss — Wed, 29 Apr 2009 03:38:57 GMT

To check if a Management Point is up and running we have the mplist and mpcert http URLs that we can open in Internet Explorer. We don’t have such URLs to test if a Distribution Point (DP) is up. Management Point and Distribution Point servers are very different roles. The Management Point is a conduit for the clients to get information from the SQL database i.e. their cert, their machine policy, etc. That is why there is a way to use an http link to get that information from SQL through the MP. A DP is nothing but a server share. To use BITS for downloads, we expose that share through a virtual IIS directory.

There is no http link with a cert on a DP that we can query on, but you can create a package just to test the DP health. Here is how:

1. Create a text file and write in it whatever you want to see when you use the http URL to test the DP.

2. Rename that file and change the txt extension to html.

3. Create a package that only contains that file and add your distribution points to the package.

4. Get the package ID and then go to the IIS Manager console and find the name of the DP virtual directory and make sure there is a folder for your DP health package.

5. Use IE and type the URL for the server, the virtual IIS directory, the package ID folder, and then your html file. In my case it looks like this:

http://sccm/sms_dp_smspkge$/zzz0002e/dphealth.html

6. You should get back the content of the text file you created on step one:

If you get the content of your html file back, your BITS enabled DP is up.

How Can I Increase The Size Of The Smsts.log File?

carloss — Mon, 19 Jan 2009 20:52:34 GMT

To troubleshoot SCCM Task Sequences we use the smsts.log located on the SCCM client. Unlike other SCCM components, the size of the smsts.lg is not configurable in the registry.

Keep in mind that Task Sequences can run even before we get the SCCM client on a computer, so the above registry key might not exist. The SMS Task Sequencer log file is by default 1 MB in size. Sometimes that is not enough to troubleshoot task sequences. To increase the size of the smsts.log we need to create a smsts.ini file and put it in the Windows directory. The smsts.ini file should loook something like:

[Logging]

LogMaxSize=5000000

LogMaxHistory=1

The above example makes the smsts.log 5 MB in size and we will keep one 5 MB history file. If you are booting up from media or PXE, you need to edit you boot image such that the smsts.ini file is in the Windows directory.

How Can We Enable Basic Proxy Authentication On The Software Update Points?

carloss — Tue, 05 Aug 2008 18:50:00 GMT

The SCCM admin console does not support configuring the Software Update Point WSUS servers to use basic proxy authentication. One could run the WSUS administration console and enable basic proxy authentication, but SCCM will overwrite those settings. The following workaround is untested and not supported in any way by Microsoft, but will allow for basic proxy authentication on a SUP server:

1. Stop Site Component Manager and SMS Executive on the SCCM server.
2. Go to WSUS and enable basic proxy authentication.
3. Go to <SCCM Install Dir>\inboxes\sitectrl.box and make a backup of the sitectrl.ct0 file.
4. Edit with Notepad sitectrl.ct0 and look for a section similar to this one:

BEGIN_SYSTEM_RESOURCE_USE
    RESOURCE<Windows NT Server><["Display=\\Server\"]MSWNET:["SMS_SITE=PS1"]\\Server\>
    ROLE<SMS Software Update Point>
    PROPERTY <UseProxy><><><1>
    PROPERTY <ProxyName><><proxyname><0>
    PROPERTY <ProxyServerPort><><><80>
    PROPERTY <AnonymousProxyAccess><><><0>
    PROPERTY <AllowProxyCredentialsOverNonSsl><><><1>
   PROPERTY <UserName><><SCMATRIX\SUMWSUSAdmin><0>
       BEGIN_PROPERTY_LIST
        <Objects Polled By Site Status>
        <["Display=\\Server\C$\Program Files\Microsoft Configuration Manager\"]MSWNET:["SMS_SITE=PS1"]\\Server\C$\ Program Files\Microsoft Configuration Manager\>
    END_PROPERTY_LIST
END_SYSTEM_RESOURCE_USE

5. Add the AllowProxyCredentislOverNonSsl line and save the file.
6. Restart Site Component Manager.

There is also a sample script here to perform these changes.

Are Duplicate GUIDs And Conflicting Records The Same Thing?

carloss — Wed, 18 Jun 2008 17:39:46 GMT

The short answer is no. There are two kinds of possible duplicate computer records in SCCM. The first one is machines with the same hardware ID. The hardware ID is unique to each computer and it is based on its hardware properties. CPU type, MAC address, memory, etc. are some of the properties used to determine the machine hardware ID. We could get conflicting records in SCCM when the OS is reinstalled on a computer. The client will get a new GUID from SCCM, but its hardware ID will remain the same. In this scenario we end up with two records in the database for the same computer. SCCM 2007 can detect and correct conflicting records automatically, or the administrator can choose to do it manually.

The second type of duplication is duplicate GUIDs. These are machines with different hardware IDs that share the same SMS Identifier or GUID. A common scenario that causes duplicate GUIDs is hard disk duplication or cloning. The auto correct conflicting records feature in SCCM will not detect or fix duplicate GUIDs. The best way to identify and fix duplicate GUIDs is by using the Managing Duplicate Globally Unique Identifiers in Systems Management Server 2003 white paper. Using the three queries documented in the white paper to create a collection and then target the collection with TranGUID, is a very easy procedure to fix clients with duplicate GUIDs. SCCM administrators should avoid duplicate GUIDs since among other things, they could affect the server performance when processing discovery and inventory data.

To summarize we could have:

1. Conflicting records – Records with the same machine ID

2. Duplicate GUIDs – Records with the same SMS Identifier or GUID

Alert - Microsoft Security Advisory 954474 Revised

carloss — Wed, 18 Jun 2008 16:35:19 GMT

What is the purpose of this alert?

This alert is to notify you that Microsoft has revised security advisory 954474 – System Center Configuration Manager 2007 Blocked from Deploying Security Updates - on 17 June 2008.

Summary:

Microsoft has completed the investigation into public reports of a non-security issue that affects environments with all supported versions of System Center Configuration Manager 2007 that deploy updates to Systems Management Services (SMS) 2003 clients. Regarding this issue, Microsoft first published security advisory 954474 on Friday, June 13^th 2008.

The revision to security advisory 954474 discusses the release of an update to correct this issue under Microsoft Knowledge Base Article 954474. Microsoft encourages customers affected by this issue to review and install this update.

Recommendations:

Please review Microsoft security advisory 954474 for an overview of the issue, details on affected components, suggested actions, frequently asked questions (FAQ) and links to additional resources. Review Microsoft Knowledge Base Article 954474 for more information on the update to fix the issue.

Additional Resources:

· Microsoft Security Advisory 954474 – System Center Configuration Manager 2007 Blocked from Deploying Security Updates - http://www.microsoft.com/technet/security/advisory/954474.mspx

· Microsoft Knowledge Base Article 954474 - System Center Configuration Manager 2007 Blocked from Deploying Security Updates - http://support.microsoft.com/kb/954474

· The Manageability Team Blog: http://blogs.technet.com/smsandmom/

· MSRC Blog: http://blogs.technet.com/msrc

Regarding Information Consistency:

We strive to provide you with accurate information in static (this mail) and dynamic (web-based) content. Security Advisories posted to the web are occasionally updated to reflect late-breaking information. If this results in an inconsistency between the information here and the information in the web-based Security Advisory, the information in the web-based Security Advisory is authoritative.

If you have any questions regarding this alert please contact your Technical Account Manager or Application Development Consultant.

Thank you,

Microsoft CSS Security Team

SCCM SP1 Fix List Is Now Available

carloss — Tue, 03 Jun 2008 00:36:45 GMT

The Configuration Manager 2007 SP1 fix list KB article has been published.

You can find it at KB953649.

SCCM 2007 Service Pack 1 Is Now Available

carloss — Tue, 27 May 2008 22:17:00 GMT

SP1 was released to manufacturing last Friday. It is now available for download at:

http://www.microsoft.com/downloads/details.aspx?FamilyId=5AAE62E8-4B7F-4AF7-BE01-AEFAA4BF059A&displaylang=en.

How much do you really know about SCCM 2007?

carloss — Fri, 09 May 2008 22:53:00 GMT

Want to test your SCCM 2007 knowledge? Then download the following quizzes…

System Center Configuration Manager 2007 Product Feature Quizzes

Overview

The System Center Configuration Manager 2007 User Assistance team has created a set of quizzes to help you assess your understanding of the dependencies and requirements for key features of Configuration Manager. These quizzes are intended to raise your level of awareness of the some of the nuances of these features before you configure and use them. They can also be used to help train other Configuration Manager administrators within your organization. Each quiz consists of 10 questions that can be answered Yes or No. Regardless of your answer, the quiz will display the correct information, and include one or more links to the corresponding related content located in the Configuration Manager 2007 Documentation Library located on the Configuration Manager TechCenter. We are testing the usefulness of this format, and ask for your feedback on the format and the content contained in each quiz. Please send feedback to SMSDOCS@Microsoft.com.

The following quizzes are available:
Configuration Manager 2007 Client Installation Quiz
Configuration Manager 2007 Client Management Quiz
Configuration Manager 2007 Client Site Assignment Quiz
Configuration Manager 2007 Desired Configuration Management Quiz
Configuration Manager 2007 Internet-Based Client Management Quiz
Configuration Manager 2007 Native Mode Quiz
Configuration Manager 2007 Network Access Protection Quiz
Configuration Manager 2007 Wake On LAN Quiz
New! - Configuration Manager 2007 Software Updates Operations Quiz
New! - Configuration Manager 2007 OSDeployment Quiz
New! - Configuration Manager 2007 What’s New Quiz
New! - Configuration Manager 2007 Software Updates Configuration Quiz
New! - Configuration Manager 2007 Mobile Device Management Quiz
New! - Configuration Manager 2007 Fundamentals Quiz
New! - Configuration Manager 2007 Client Roaming Quiz
New! - Configuration Manager 2007 Software Updates Interop Quiz
New! - Configuration Manager 2007 Setup Quiz
New! - Configuration Manager 2007 Software Distribution Quiz

What are the licensing requirements to use SCCM R2's integration with Softgrid?

carloss — Fri, 09 May 2008 21:56:07 GMT

A customer must have purchased the Microsoft Desktop Optimization Pack and be licensed to use SoftGrid 4.5. With the appropriate Softgrid client licenses, SoftGrid server infrastructure can be freely distributed and used throughout the customer’s hierarchy. The SoftGrid 4.5 client is required for the integration with SCCM.

System Center Documentation Search Gadget

carloss — Fri, 09 May 2008 19:42:00 GMT

Do you want an easy way to search the online SCCM 2007 documentation? You need to try the System Center Content Search gadget for the Windows Vista Sidebar.

The gadget is also good for searching the documentation of other System Center products.

Where is the software updates data in the SCCM database?

carloss — Fri, 09 May 2008 02:12:00 GMT

If you had a custom report or a SQL query in SMS 2003 to find what machines installed an update or what machines were missing it, and you upgraded to SCCM, you probably found out that your report or query no longer works. This is because there are new tables in the SCCM database to store software updates information. SCCM does include reports for software updates compliance, but what if I want a quick SQL query or a custom report?

We can use the v_UpdateInfo to find updates data like their Bulletin ID, their KB article, their description, etc. We can also use the v_Update_ComplianceStatusAll view to find updates scan data, or the status of a specific update on your clients. The status for the software updates is a numeric field so let me translate them for you:

0 = Detection state unknown

1 = Update is not required

2 = Update is required

3 = Update is installed

So now that we have the views we need and the meaning of the update status values, we can write our own report or query. If I wanted to query SQL to find out all the clients that installed security bulletin MS07-064, the query will look something like this:

select Name0 as ComputerName

from v_R_System a

left join v_Update_ComplianceStatusAll comp on a.ResourceID=comp.ResourceID

join v_UpdateInfo ui on comp.CI_ID=ui.CI_ID

where comp.Status = 3 and ui.BulletinID = 'MS07-064’

If I wanted to know the clients missing that security bulletin I would change “where comp.Status = 3” to “where comp.Status = 2”.