Configuration Manager Writers - Announcements, Comments and other Stuff

Cannot Select Option for Branch Distribution Point in a Native Mode Site

I’ve been seeing quite a few customer questions about not being able to select the branch distribution point option for a Configuration Manager site system – the option is disabled in the distribution point properties, but without any explanation.  Most of the time it’s because the Configuration Manager client isn’t installed on the selected site system, which is a prerequisite for a branch distribution point.  Another scenario that results in disabling this option is if the computer is a workgroup client rather than domain-joined. However, there have a few occasions where the client has been installed on a domain computer, and on investigation they have been on native mode sites that are configured for Internet-based client management.

We clearly document that a branch distribution point is not supported on the Internet, and that clients on the Internet cannot connect to branch distributions points.  The two configurations are mutually exclusive.  However, some customers took this to be an operational support statement only, rather than a programmatic support statement.  What I mean by this is, they installed the client and configured it with an Internet-based management point, but had no intention of moving the client from the intranet, and then attempted to configure it as a branch distribution point. 

Why configure a client for Internet-based management when it would never leave the intranet?  Ease of administration.  Customers had added the CCMHOSTNAME command line property to the client push option so that all clients in the site were automatically configured for Internet-based client management.  Unfortunately, the documentation actually says Configuration Manager will not prevent this configuration although it is not supported:

Do not create branch distribution points on Internet-based clients. Although Configuration Manager does not prevent you from doing so, creating any type of distribution point on an Internet-based client greatly increases your attack surface and should be avoided.

I remembered a request to block this combination in the Configuration Manager console, and that the request was not taken, with the mitigation being documentation.  Hence the statement above that appears in multiple places in the Configuration Manager documentation library.  So when I heard that customers were not able to create branch distribution points because the client was configured for Internet-based client management, I decided to look into this.

It seems that the option to block this combination was taken later in the product cycle, with the use of an InternetEnabled flag in the code, but the documentation team wasn’t informed – which is why we didn’t update the documentation.  However, before revising the documentation I tried to reproduce it and couldn’t: my client was configured for Internet-based client management and I could select the option to enable it for a branch distribution point.  This had me banging my head against the keyboard until I finally realized that I was testing it differently to how customers had reported it.  They were installing the client with the CCMHOSTNAME option, whereas I already had my native mode clients installed and added the Internet-based management point in the client properties, on the Internet tab.  So I reinstalling the client with the CCMHOSTNAME option, but still the option for a branch distribution point wasn’t blocked.  I tried initiating hardware inventory, discovery data, and configured all my schedules to run with really low values and left it for a few days.  Still the option for a branch distribution point wasn’t blocked in the distribution point properties.

Thanks to our test engineers Adam Meltzer and Tony Meng, we finally discovered that although the intent was to reset the InternetEnabled flag with a DDR and hardware inventory, it’s actually only set at registration.  That’s why even reinstalling didn’t make any difference where I configured the Internet-based management point after the initial installation and found that I could still select the option to enable the branch distribution point. However, what I hadn’t realized is that although the branch distribution point successfully installs with this unsupported combination, packages will not install and are stuck at “Install Pending”.

Typically, the product team does not test what happens if you configure something that isn’t supported. However, if you find yourself in either of these situations, how to recover is not obvious because simply reconfiguring the client or reinstalling is not sufficient.

If you cannot select the branch distribution point option because you have installed the client with the CCMHOSTNAME option:

1. Delete the Internet-based management point value in the client properties (Internet tab), and click Apply or OK.
2. Delete the client in the Configuration Manager console.
3. Restart the client (SMS Host Agent service).
4. Initialize the Discovery Data Collection Cycle in the client properties.
5. Wait a few minutes for the discovery data cycle to be processed and sent to the site, and then you should be able to select the option for the branch distribution point.

At this point, you can manually update the collection membership and press F5 if you need to immediately manage the client through collections.  Or you can wait for the client to automatically reappear, according to your collection membership update cycle.

Note that if you have installed the client with the CCMHOSTNAME property, you cannot reinstall the client and clear this value – this one also had me scratching my head for a while until it was confirmed that it couldn’t be done.  You can't unset it or set it to a null value.  Instead, you must uninstall first and then reinstall without the CCMHOSTNAME property, or delete the value in the client properties.

If you have selected the branch distribution point option for a client that is configured with an Internet-based management point:

1. Delete the Internet-based management point value in the client properties (Internet tab) and click Apply.
2. Initialize the Branch Distribution Point Maintenance Task action on the client, and the packages that were pending install will immediately start to install.

I’m revising the documentation for this information and it will be published to the Web when Configuration Manager 2007 R2 releases, with the recovery steps in "Troubleshooting Software Distribution Issues". In the meantime I hope that posting this information early will help other customers who unknowingly run into this unsupported combination. 

This posting is provided AS IS with no warranties and confers no rights.

Upgrading the Windows AIK for Configuration Manager 2007 SP1

Before beginning the upgrade process to Configuration Manager 2007 SP1, the Windows AIK 1.0 should be uninstalled from the SMS Provider computer for the site to allow SP1 Setup to install Windows AIK 1.1 to support SP1 OSD WIM images.

If the Windows AIK 1.0 is not uninstalled prior to beginning SP1 Setup, and a PXE service point is installed in the site running the Windows Deployment Services (WDS) Server service, the upgrade might fail and result in an unexpected restart and post-upgrade SMS Executive service crashes.

The following information has been added to the documentation libary for Configuration Manager 2007, but we won't be able to publish it to the Web until  we refresh the documentation libary when Configuration Manager 2007 R2 is released. In the meantime, I'm making this post to give you the information that you need to successfully upgrade Configuration Manager 2007 sites to SP1 and troubleshoot an issue that you might encounter.

Because Configuration Manager 2007 SP1 sites require Windows AIK version 1.1 to be installed on the SMS Provider computer, the Windows AIK must be upgraded to version 1.1 from version 1.0 during primary site upgrades to Configuration Manager 2007 SP1. If a PXE service point site system has not been installed for the site to be upgraded, Configuration Manager 2007 SP1 Setup will automatically upgrade the Windows AIK 1.0 installation on the SMS Provider computer to version 1.1 during the upgrade process. However, if a PXE service point has been installed for the site to be upgraded, the Windows AIK should be manually uninstalled from the SMS Provider computer for the site before beginning service pack installation. If the Windows Deployment Services (WDS) Server service is running, and has the wimgapi.dll file is in use, an unexpected restart can occur while upgrading the site to Configuration Manager 2007 SP1.

For more information about troubleshooting unexpected system restarts during Configuration Manager 2007 SP1 Setup, see Troubleshooting Configuration Manager 2007 SP1 Setup.

If a PXE service point site system is installed on a computer other than the SMS Provider computer for a site, the wimgapi.dll file used by PXE service point components is not updated to the newest version. Because the updated wimgapi.dll file version is required for Configuration Manager 2007 SP1 PXE service points, operating system deployments using the remote PXE service point will fail until the file is replaced with the new version.

The following procedures can be used to upgrade the Windows AIK during site upgrades to Configuration Manager 2007 SP1 when a PXE service point site system has been installed for the site.

To Upgrade Windows AIK When a PXE Service Point Site System Role is Installed on the SMS Provider Computer for a Site

1.     On the computer hosting both the PXE service point and SMS Provider site system roles for the site to be upgraded, manually uninstall Windows AIK 1.0 from Add or Remove programs and restart the operating system to complete the uninstallation.

2.     Stop the Windows Deployment Services (WDS) Server service. At a command prompt, enter the following command to stop the service: net stop WDSServer and run Configuration Manager 2007 SP1 Setup to upgrade the site and allow Windows AIK 1.1 to be installed.

3.     After the site has been successfully upgraded, restart the Windows Deployment Services (WDS) Server service. At a command prompt, enter the following command to start the service: net start WDSServer.

To Upgrade Windows AIK Files on Remote PXE Service Point Site Systems After Configuration Manager 2007 Service Pack 1 Installation

1.     On the computer hosting the PXE service point site system role, stop the Windows Deployment Services (WDS) Server service. At a command prompt, enter the following command to stop the service: net stop WDSServer.

2.     On the PXE service point computer, navigate to the .\sms\wim directory and run the wimgapi.msi file to install the new version of wimgapi.dll.

3.     After the successfully upgrading wimgapi.dll to the correct version, restart the Windows Deployment Services (WDS) Server service. At a command prompt, enter the following command to start the service: net start WDSServer.

Already tried to upgrade to Configuration Manager 2007 SP1 without following the above procedures? You might have encountered some unexpected restarts and had some SMS Exec service crashes. Here’s how to fix them:

Configuration Manager 2007 SP1 Setup May Cause Unexpected Restarts

If a PXE service point has been installed for the site to be upgraded, the Windows AIK should be manually uninstalled from the SMS Provider computer for the site before beginning service pack installation. If the site server being upgraded has the Windows Deployment Services (WDS) Server service running, and the wimgapi.dll file is in use, an unexpected restart can occur because Windows AIK 1.1 installation requires a system restart to replace this file. Additionally, after the computer restarts, the SMS Executive Configuration Manager Service might fail repeatedly.

Solution

The following procedure can be used to prevent further unexpected restarts during the SP1 upgrade and troubleshoot SMS Executive service failures.

To prevent further unexpected restarts during the SP1 upgrade and troubleshoot SMS Executive service failures

1.     Manually uninstall the failed Windows AIK 1.1 installation from Add or Remove programs and restart the computer.

2.     Stop the Windows Deployment Services (WDS) Server service. At a command prompt, enter the following command to stop the service: net stop WDSServer.

3.     Determine if the SMS Executive service is failing by reviewing the contents of the .\<Configuration Manager Installation Directory>\Logs directory for the presence of a CrashDumps folder. If this folder exists, check for sub-folders created after the unexpected restart.

4.     If subfolders were created in the CrashDumps directory after the unexpected system restart, navigate to the .\ <Configuration Manager Installation Folder>\inboxes\hman.box directory and delete any files present with a .ct2 file extension.

5.     Run Configuration Manager 2007 SP1 Setup to upgrade the site and allow Windows AIK 1.1 to be installed.

6.     After the site has been successfully upgraded, restart the Windows Deployment Services (WDS) Server service on the SMS Provider computer. At a command prompt, enter the following command to start the service: net start WDSServer.

 ~Jeff

Just Published on TechNet: How to Configure ISA SSL Bridging for System Center Configuration Manager Internet-Based Client Management

- Carol

This posting is provided AS IS with no warranties and confers no rights.

Having Problems Deploying the Certificates for Native Mode with a Windows Server 2008 CA?

Smart Searching with the Vista Gadget System Center Content Search - as shown at MMS, only Better!

This Vista search gadget from the System Center SDK UA team (and special kudos here to Chris Scoville) is really useful, as well as cool. And it’s available for you to download from the Windows Vista Gadget Gallery.

Download link: http://go.microsoft.com/fwlink/?LinkId=118338

[Note: As with all downloadable gadgets on the Vista Gadget Gallery, you will see a notice that it’s a third-party application.  However, it is signed by Microsoft so that you know it comes from us.]

In case you haven’t heard about it, this gadget allows you to more efficiently find technical information for System Center products by using Live Search macros to search sites scoped to selected System Center products instead of searching the entire Web.

The gadget was demonstrated at MMS, but has been recently upgraded to include new functionality, a new look (incorporating the new server product branding logos), and fix issues that were reported. If you installed the previous version, go ahead and install the new version - it will detect the previous version and upgrade appropriately. The original version was v1.0 and this new version is v2.0.  

To check which version you have installed:

1. Click the + icon at the top of the sidebar.
2. Click the System Center gadget in the window, and then click Show details
3. The bottom of the window shows the full name and version for the gadget.  The new version displays: System Center Content Search 2.0.0.0.
4. Close the window.

In its default configuration, search results are returned in a tabbed window as follows:

• TechNet
• MSDN
• Microsoft.com
• Downloads
• Videos/Media
• Webcasts
• Blogs
• Forums
• Microsoft Learning
• Web

The default configuration includes results for all System Center products. But it gets to offer really smart searching when you scope your search to just one product – for example Configuration Manager. Now the tabbed results are more specific, which explains why the tabs displayed are dependent upon the product selection.

What I like best about this gadget: It gathers together all relevant blogs in one place.

What I like second best about this gadget:  I don’t have to worry about including “Configuration Manager” “ConfigMgr” and “SCCM” in the search.

As an example, let’s say that you have a particular question or problem related to Configuration Manager native mode. A standard search for “native mode” might return results from Wikipedia as a generic computing term, or provide documentation related to other products’ “native mode” settings.

But with the search gadget, right-click it, select Options, and then select search results for Configuration Manager:

Is the Documentation for Migrating a Site to Native Mode Missing a Step to Uninstall/Reinstall the Management Point?

This is a question I was asked recently on our TechNet forums, from a customer who had successfully migrated 8 sites to native mode.  He found that if he uninstalled the management point, migrated the site, then reinstalled the management point – the migration went much smoother and asked if this step was missing from the documentation.

What I think he stumbled upon, was a quirky, intermittent problem we’ve seen a few times but can’t yet pin down – and we suspect it’s an odd timing issue. Configuration Manager thinks that the site migration is successful (see How to Verify Native Mode Migration Is Complete), and clients pick up the native mode client communication (see How to Determine the Site Mode for a Configuration Manager Client), but clients don’t successfully communicate with the management. They might fail to download policy, or download policy but then reject it. A good symptom to watch out for is that although they say that they are assigned with the correct site code, the Client column in the Configuration Manager console displays No.

What seems to be happening is that some registry key values aren’t being populated as expected. Uninstalling and reinstalling the management point triggers a repopulation, although sometimes the uninstall/reinstall needs to be done more than once.  The registry key to check is HKLM\Software\Microsoft\SMS\MP. When you look at this registry key with Regedit, you’ll see a list of values. The ones at the bottom of the list (shown below) are related to the native mode certificate settings and each one should have data associated with it.

If you see values here that are missing data (blank) after migrating a site to native mode, try uninstalling and reinstalling the management point, refreshing the Regedit display, and checking again.  When these values are correctly populated with data, clients will automatically recover by themselves in time, or to expedite the process you can reinstall them. If the native mode management point is being used for Internet-based clients, make sure that the PublicDNSName value is also populated (blank in the picture example).

We’ve flagged this up to CSS because we’ve seen it often enough to be concerned that there is something odd going on here, but there’s no KB published or planned at this point because we haven’t yet identified the exact cause.  Identifying the problem is tricky, because migrating the site shouldn’t need to uninstall/reinstall the management point (which is why it isn’t in the documentation) but seems to resolve the issue. The exact symptoms you see can vary, depending on which data values are missing – so some of the error messages in the logs can be misleading.

You can find more information about this from the SMS&MOM blog (see ConfigMgr 2007: Clients fail to connect to a Management Point after moving from Mixed to Native mode), where J.C. Hornbeck has included examples of typical log file entries that we’ve found related to this issue.  And when we know more, we will let you know.

- Carol

This posting is provided “AS IS” with no warranties and confers no rights.

SP1 Releases! – with Updated Documentation

Problems Opening Help Files After Copying From another Computer

Having been caught out by this myself yesterday, I thought I’d pass this little tip onto you. From time to time, you might want to copy help files to another computer, perhaps to look at a new version you’ve downloaded from the Web, or to copy the help file from a machine running the Configuration Manager console to a laptop to read at home.

Sometimes, when you copy chm files from one computer to another (or download them from the Web), you might find that when you open the file on the destination computer and click any item in the chm contents, a ‘page not found’ error is displayed.

This is due to a security feature in Windows XP and Windows Vista that might block content that has been copied from another computer. To unlock the file and see the content, right-click the file and select Properties. On the General tab of the file properties dialog box, click the Unblock button.

Hopefully, this helps out anyone who got caught out like I did!

What are these DCM terms: “SDM Package”, “SDM Type ID”, “SDM Type Version”, “Model Name” ??