Jeff Gilbert's Web blog at myITforum.com

How To Configure ISA SSL Bridging for Configuration Manager Internet-Based Client Management

jgilbert — Thu, 03 Jul 2008 17:54:00 GMT

In case you missed it (you do read our writers' blog don't you?! http://blogs.technet.com/wemd_ua_-_sms_writing_team/default.aspx), Carol has just posted about the new documentation she was heavily involved in creating about ISA SSL bridging now being available on TechNet.

From Carol:

Just Published on TechNet: How to Configure ISA SSL Bridging for System Center Configuration Manager Internet-Based Client Management

I'm delighted to let you know that the ISA Server documentation team has just published How to Configure ISA SSL Bridging for System Center Configuration Manager Internet-Based Client Management.

This has been a joint collaboration between the ISA Server product group and the Configuration Manager product group – and special thanks to Jim Harrison (ISA Server PM), Nathan Bigman (ISA Server Content Publishing Manager), and Adam Meltzer (Configuration Manager test engineer).

I would also like to add my thanks to our ISA friends and reviewers:

Jason Jones (ISA expert from Silverlands Limited, with his own blog at http://blog.msfirewall.org.uk/)
Tom Shinder (ISA MVP, consultant, trainer, author of many best-selling books and articles – check out http://blogs.isaserver.org/shinder/ )

Wondering if SMS 2003 SP3 or Configuration Manager 2007 Supports Vista SP1 or Windows Server 2008 Clients?

jgilbert — Fri, 27 Jun 2008 22:00:00 GMT

Wonder no more! The updated SMS 2003 SP3 Supported Configurations document has been updated to reflect support for both Windows Vista SP1 and Windows Server 2008 clients. The Configuration Manager 2007 RTM supported configurations has also been updated to reflect support for these operating systems.

The latest SMS 2003 SP3 Supported Configurations document can be found online here: http://technet.microsoft.com/en-us/library/cc179956.aspx.

The latest Configuration Manager 2007 RTM Supported Configurations document can be found online here: http://technet.microsoft.com/en-us/library/cc161860.aspx.

Here's some more quick information about this update:

It is not supported to install the SMS 2003 SP3 or Configuration Manager 2007 RTM admin console on Windows Server 2008.
It is supported to install the SMS 2003 SP3 or Configuration Manager 2007 RTM admin console on Windows Vista SP1.
It is not supported to install any site system roles on either operating system, with the exceptions of:
- Windows Vista and Windows Server 2008 as branch distribution points in Configuration Manager RTM
- Windows Server 2008 as a System Health Validator (Network Policy Server for NAP) in Configuration Manager RTM
Neither release supports the Windows Server 2008 Core Installation option at this time.

OK, so you've got SMS 2003 SP3 installed with Vista SP1 clients, but you can't narrow down package properties to only run on Vista SP1?

You need this hotfix: SMS 2003 with Service Pack 3 cannot deploy a package to client computers that are running Windows Vista with Service Pack 1.

System Center Online authentication certificate for AI sync points

jgilbert — Mon, 02 Jun 2008 23:07:00 GMT

The Asset Intelligence synchronization point (ConfigMgr SP1 site system role) needs to be provisioned with an authentication certficate issued by System Center Online to provide on-demand catalog updates. To get the certificate, you must have an active SA contract with Microsoft for Configuration Manager.

Read more about it here:
How do I get the System Center Online Cert for AI 1.5?

What's coming in System Center Configuration Manager with Bryan Keller

jgilbert — Wed, 07 May 2008 17:01:00 GMT

Curious about what is coming with Configuration Manager 2007 SP1 or R2? Check out Adam Carter's video interview with Bryan Keller at MMS 2008 on TechNet edge where he demo'd some cool stuff including Asset Intelligence in Configuration Manager 2007 SP1 (AI 1.5) and virtual application management capabilities coming with Configuration Manager 2007 R2:

http://edge.technet.com/Media/Whats-coming-in-System-Center-Configuration-Manager-with-Bryan-Keller/

~Jeff

Inserting auto-text in a Word document

jgilbert — Fri, 18 Apr 2008 19:24:00 GMT

I think this is pretty cool and fun to play with (I like to insert things like this in documentation tech reviews to see if anyone notices…).

Anyway, to automatically insert random text in a doc, you can use the =lorem() or =rand() commands. The =lorem() command inserts the "lorem ipsum" Latin gibberish and the =rand() command inserts random strings from the help file J Using either command you can also specify the number of paragraphs or sentences in the ()'s. So to insert 3 paragraphs of Latin gibberish with each paragraph being 5 sentences long, you would use =lorem(3,5) and then just hit enter.

=lorem() <enter> gives you this:

Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Maecenas porttitor congue massa. Fusce posuere, magna sed pulvinar ultricies, purus lectus malesuada libero, sit amet commodo magna eros quis urna.

Nunc viverra imperdiet enim. Fusce est. Vivamus a tellus.

Pellentesque habitant morbi tristique senectus et netus et malesuada fames ac turpis egestas. Proin pharetra nonummy pede. Mauris et orci.

NOTE: =lorem() only works in Word 2007

If you're wondering what all that lorem ipsum stuff really means, check this out: http://support.microsoft.com/kb/114222

Moving along, =rand() <enter> gives you this:

On the Insert tab, the galleries include items that are designed to coordinate with the overall look of your document. You can use these galleries to insert tables, headers, footers, lists, cover pages, and other document building blocks. When you create pictures, charts, or diagrams, they also coordinate with your current document look.

You can easily change the formatting of selected text in the document text by choosing a look for the selected text from the Quick Styles gallery on the Home tab. You can also format text directly by using the other controls on the Home tab. Most controls offer a choice of using the look from the current theme or using a format that you specify directly.

To change the overall look of your document, choose new Theme elements on the Page Layout tab. To change the looks available in the Quick Style gallery, use the Change Current Quick Style Set command. Both the Themes gallery and the Quick Styles gallery provide reset commands so that you can always restore the look of your document to the original contained in your current template.

~Jeff

More Configuration Manager quizzes available!

jgilbert — Thu, 03 Apr 2008 17:07:00 GMT

The Configuration Manager 2007 writing team has just published a second batch of quizzes to test your knowledge of Configuration Manager 2007. These quizzes are a great way to learn more about some of the features of the product. Each quiz contains 10 questions that can be answered Yes or No. Regardless of your answer, the quiz will display the correct solution and provide links to the Configuration Manager online documentation.

For more information, see the writers' blog post about it:
http://blogs.technet.com/wemd_ua_-_sms_writing_team/archive/2008/04/03/test-your-knowledge-of-configuration-manager-2007-again.aspx

~Jeff

Check out Ryan's blog!

jgilbert — Tue, 01 Apr 2008 16:59:00 GMT

Ryan Anderson (CSS support escalation engineer) has a new blog that has some really good stuff on it!

Check it out: http://blogs.technet.com/ryanan

~Jeff

Testing management points the Configuration Manager 2007 way

jgilbert — Sun, 16 Mar 2008 20:48:00 GMT

Testing management point connectivity is just one of those things that SMS/ConfigMgr admins need to do on a regular basis. You can always peruse the mpcontrol.log to check management point health, but to make it easier, the product team has provided some handy test urls that can be used instead of reviewing the mpcontrol.log all the time.

Using the management point test urls is a pretty old tip. It's documented in a ton of places including the SMS 2003 FAQ, the Configuration Manager 2007 documentation, and a myriad of other Web locations. However, there is a catch when using these test urls in Configuration Manager sites that may not seem obvious at first and is a change from SMS 2003 behavior. I noticed this while working on something in my lab so I figured it would be a good tip to pass along.

When testing management point connectivity in SMS 2003 sites, you just open up a Web browser instance and go to: http://<ManagementPointName>/sms_mp/.sms_aut?mplist. If all is well with the management point you will see:

(Yes, I know there's nothing there...that's a good thing for SMS 2003 sites and what you should see if the management point is responding to http requests )

In Configuration Manager sites, you actually do see something when you browse to the test urls and Don Hite has done a nice job documenting some of that behavior in his blog already.

So, in SMS 2003 sites, seeing nothing is good and something (IIS errors) is bad. In Configuration Manager sites, seeing something is good and nothing (IIS errors) is bad...that sounded a lot clearer in my head.

Anyway, moving on. If you browse to that mplist url while checking management point communication in a Configuration Manager 2007 site, you will see something like:

Notice anything odd there? You entered the url to test one management point and Viola! all the management points in the site appeared. So, you may think to yourself, "Wow! Now I only need to check one test url to verify all the management points are working and all must be good with all of the management points displayed" so now you can stop checking right? WRONG!!!

When using the mplist test url, you much change it each time to verify that the management point defined by <ManagementPointName> is online and functioning properly. This is because, when the management point test url is queried, it connects to the site database and retrieves a list of management points and displays them. It does not connect to each management point listed in the query results displayed. Don't believe me? Check this out (and no I won't tell you what database table I'm altering here!):

So now you know that you need to test each management point individually right? Now, lets talk about what generally happens when you don't see what you're supposed to see displayed when using the test url.

Oops. IIS 500 error. In general, IIS 500 errors are telling you that something has gone wonky with the site database or access permissions to it for the management point computer.

Uh-oh. IIS 404 error. IIS is taking a nap or has become completely catawompus for some other reason.

Those are just a couple of quick examples of failed management point communication and are generally the most frequently seen so I added them to this post. The main reason for my posting this blog entry is not to fully discuss management point failure conditions, but rather just to let you know that even though you see multiple management point computers returned by the mplist test url, you definitely still need to check each management point individually.

Hope this helps,

~Jeff

The Configuration Manager 2007 SDK has shipped!!!

jgilbert — Sun, 16 Mar 2008 20:09:00 GMT

At long last, the Configuration Manager 2007 SDK has shipped! This is really a great release and the product of a lot of hard work by only a few SDK writers.

Some stats that compare this release to the SMS 2003 SDK release that may surprise you:

Configuration Manager

SMS 2003

Words

1,136,512

396,803

Topics

Conceptual/non-managed	1,840
Managed	2,362
Total	4,202

Conceptual/non managed	670
Managed	1,902
Total	2,572

Code Snippets

470

200

Considering that there were 8+ years of work in the SMS 2003 SDK and the Configuration Manager 2007 SDK is the result of only the last 1.5 years, I think these guys did an amazing job

Oh yeah, in case you're wondering how to get it, here you go: http://go.microsoft.com/fwlink/?LinkId=113689 .

Happy coding,

~Jeff

How Asset Intelligence installed software inventory information is collected

jgilbert — Sun, 16 Mar 2008 20:04:00 GMT

For those interested in figuring out how Asset Intelligence inventories information about the installed software found on clients...here you go:

How and where is AI data collected on the client

~Jeff

Asset Intelligence role-based management capabilities in Configuration Manager 2007 SP1

jgilbert — Sun, 16 Mar 2008 19:33:00 GMT

Changes to the Asset Intelligence feature in Configuration Manager 2007 SP1 (Asset Intelligence 1.5) have enhanced the inventory and management capabilities of previous releases to better identify and manage hardware, software, and software licenses in use by Configuration Manager clients throughout the enterprise.

The enhancements made enable administrators to more easily, and more accurately, inventory and manage hardware assets and the software in use by Configuration Manager 2007 clients as well as import, view, and manage purchased software license information (both Microsoft and non-Microsoft). The Asset Intelligence catalog has been expanded to contain categorization and identification information for over approximately 300,000 (probably more) software titles and versions and the hardware requirements information for many software titles found in today's IT environments. The ability to customize the Asset Intelligence catalog with additional software categorization and hardware requirement information has also been added. By providing access to this essential information, Asset Intelligence 1.5 makes it easier for administrators and asset managers to more effectively plan for upgrades, migrations, and software license compliance reporting.

So, the question is how do administrators make this information available to asset managers without allowing them too much control over the actual configuration of the site and site settings?
The answer: role-based access security for Asset Intelligence information stored in the site database

In Asset Intelligence 1.5, there are now two user role types that can be used to manage access and security permissions for Asset Intelligence catalog information: Administrator and Asset Manager.

Members of the Asset Intelligence Administrator security role have full control permissions over catalog data and the Asset Intelligence feature set as a whole.
Members of the Asset Intelligence Asset Manager security role have permissions to run reports, change or create software categories and families as well as access to the Asset Intelligence Configuration Manager console home page information. Members of the asset manager role can view catalog data and categorize it to a certain extent, but otherwise have no control over the configuration or management of the Asset Intelligence feature.

For more information about these roles check out this forum post:
Security access based on role in AI 1.5

Additional information about these roles, and how to configure them, will be in the next documentation release as well.

~Jeff

Using Configuration Manager Internet-based client management and have questions about ISA?

jgilbert — Sat, 23 Feb 2008 18:31:00 GMT

When implementing Internet-based client management in Configuration Manager 2007 with ISA Server, you may run into ISA configuration issues--and many of you out there have. While we do our best to document everything we think you'll need to know to be successful ConfigMgr admins, some things are just beyond our control. I know we recommend bridging over tunneling, but I know about as much about that as building real bridges and tunnels :-)

There are many ISA Server-related resources out there to help you if you get stuck. For ISA-specific information, you can peruse the ISA Server documentation online and the ISA Server newsgroups. For help with Internet-based configuration, check out the Configuration Manager Internet-based client management documentation and if you're trying to get ISA bridging to work, check out how Adam (one of our testers) got this working.

Still have questions? You probably already know that there is a documentation feedback e-mail alias for SMS/ConfigMgr (smsdocs@microsoft.com), but did you know that there is one for ISA Server as well (isadocs@microsoft.com)? For questions and concerns for how to configure ISA for use with Configuration Manager, send your feedback to both aliases (smsdocs and isadocs) at the same time, which will allow the appropriate team to answer your questions about the products they know and love.

~Jeff

Adam Meltzer's Configuration Manager native mode/PKI blog

jgilbert — Fri, 15 Feb 2008 04:53:00 GMT

If you're using Configuration Manager 2007 in native mode, are planning to implement a native mode site or migrate a mixed mode Configuration Manager site to native mode then you really, really, and I mean really, need to watch Adam's blog: http://blogs.msdn.com/ameltzer/default.aspx

From his blog:

Hello, readers. My name is Adam Meltzer and I'm a Software Development Engineer in Test for the System Center Configuration Manager product. The purpose of this site is to cover some advanced configuration aspects of the product, notably those around integration with other Microsoft products that may not be covered specifically in our documentation. I hope to answer some of the nagging questions that have been popping up in the forums as of late and put some debates to rest. My areas of expertise are around such new features as native mode, mixed mode, and Internet Based Client Management. I'll be focusing a majority of my posts around these features.

I try to be as responsive as possible to questions, and if you have anything you want me to cover, just let me know!

The SMS 2003 Asset Intelligence catalog update package has been refreshed!

jgilbert — Thu, 07 Feb 2008 21:27:00 GMT

The issue with the SMS 2003 Asset Intelligence catalog update has been resolved and a new package posted to the download site. So, if your site database was hosted on a SQL 2000 instance and you received syntax, constraint creation, or other errors previously during the bulk import you should get the new catalog update!

The download link is http://www.microsoft.com/downloads/details.aspx?FamilyID=3653e00b-6a0f-4226-87d7-02d3df2147d7&displaylang=en

The Asset Intelligence forum has also been updated to reflect the new refresh as well as root cause:

http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=2789734&SiteID=17

~Jeff

Finding Installed Editions of SQL Server Using SMS 2003 Hardware Inventory

jgilbert — Sun, 27 Jan 2008 21:38:00 GMT

If you're running SMS 2003 SP2 (or earlier versions of SMS 2003) then inventorying SQL Server installations can be a little difficult. The information displayed in Add/Remove programs for SQL Server installations does not provide you with enough detail to determine the edition installed or even whether or not the computer only has the client tools installed-and definitely nothing about the licensing information associated with it.

Note: If you're running an SMS 2003 SP3 site (with Asset Intelligence installed) or a Configuration Manager 2007 site, then ignore this post, do not pass Go, and go directly to Asset Intelligence License Report 01A! Asset Intelligence reporting is designed just for situations like this. If you're running an SMS 2003 SP2 or below site, then after you see what you need to go through to get the same information that Asset Intelligence gets by default, it may just be enough to convince you to install SMS 2003 SP3 (with Asset Intelligence) or Configuration Manager!

I've been confounded by this for a while now, and have even managed to use SMS 2003 hardware inventory to determine which computers have the full database engine installation of SQL Server installed versus just the client tools, but determining the edition (Standard, Enterprise, Developer, etc...) has always eluded me. I just couldn't find this information in the registry or WMI of SQL Server computers. This doesn't mean it's not there necessarily, just that I couldn't find it.

Of course, the nice thing about working for Microsoft, is that help is only an e-mail away and I've done a lot of e-mailing the past few days

Big thanks to Jim Bradbury (SMS SDK writer) who wrote the .sql and .vbs files!

Finding this information without Asset Intelligence is not easy, but it is possible. Here's a quick rundown of how to do it:

Create a collection of computers that have SQL Server installed based on the Add/Remove programs information collected via standard SMS 2003 hardware inventory. Make sure your collection only contains computers running operating systems capable of installing the full database engine and not workstations that can only install the client components.
Use software distribution or manually run a .sql script on all SQL Servers in the collection created in step 1.
Modify the SMS 2003 SMS_def.mof file to inventory the information stored in the registry when the .sql from step 2 is used.
Create a query or report to view the newly collected information.

Before I continue here, you should know that this procedure requires some serious disclaimers (notice how long this section is...considering SMS 2003 SP3 with Asset Intelligence yet?):

To run the .sql script, the account used requires rights to access the registry and the master database.
The .sql script used to determine the SQL Server installation information uses an undocumented extended stored procedure to write to the registry. This means that it is not officially supported and subject to not working at some point in the future-use at your own risk.
I've only done very limited testing of this procedure in my lab environment. If you're going to use this method, be sure to test it in your lab environment, and then go test it again, before introducing these changes in your production environment.
Using this method to write information to the registry is kind of like using a NOIDMIF file or any other scripted method that writes to the registry. You'll need to re-run this .sql script on the computers with SQL Server installed periodically to get the most current information. Also, if SQL Server is uninstalled, the registry entries created by running the .sql script will not be removed and you may end up with conflicting information based on the collections/reports created using this custom information versus the information returned via Add/Remove programs. To mitigate this, base the queries/reports for this information only on systems that show up in your SQL Server collection (based on Add/Remove programs information). You might also want to run another program first to delete the registry key information and only repopulate later using the .sql script if SQL Server is still installed. Of course, SQLCMD.EXE won't work if SQL Server is no longer installed, and this will help keep the registry free from unneeded entries. A quick .vbs to do this is provided here (rename the extension from .txt to .vbs before using it).

OK, on to the good stuff. This post is already becoming long so I'm not going to show the actual files here, I'll just describe them and give you links to view them. When viewing these as .txt files in a Web browser, the formatting leaves something to be desired. For best results, right-click the link and save them somewhere to view. All of the linked files have been renamed with a .txt extension so I could upload them and make them easier to read without them actually doing anything. To get the files with their 'real' extensions, use the link to save the entire .zip at the bottom of this post.

After you've created the collection of computers that report SQL Server installed via Add/Remove programs information obtained through hardware inventory, you need to somehow run the .sql script on them to populate the registry with the information we're after.

To run the .sql script on SQL Servers, you need to use SQLCMD.EXE. Since I've named the .sql script SQLInfo.sql, the command to use is: SQLCMD -i SQLInfo.sql. If you're running this locally via a command prompt, ensure that the account you're using can write to the registry and has rights to the master database. When run, the .sql script does a few nifty things:

Creates some variables
Runs SQL Server SELECT queries to get the information we're after into those variables
Uses the undocumented extended stored procedure xp_regwrite* to write the information to the registry
NULLs out the variables at the end to clean up

* This extended stored procedure is not officially documented and therefore not officially supported. Use at your own risk.

Once you've got the information in the registry, next up is an SMS_def.mof hardware inventory modification using the Registry Property Provider to read those keys and get them in the database. To see this information, you can create queries based on it or reports to view the information. When viewed in Resource Explorer, the information looks like so:

To determine the version of SQL Server running using the version value, check out this link. The license type value can be PER_SEAT, PER_PROCESSOR, or DISABLED. The number of licenses is the number of client licenses registered, processors licensed for that instance, or NULL if licensing is disabled.

Of course, this is a long way to go, and not a very fun way to get there, when trying to inventory SQL Server installations...and to be honest, if I was an SMS 2003 SP2 admin I'd be much more inclined to just install SMS 2003 SP3 with Asset Intelligence or even make the move to Configuration Manager 2007 to get this information the easy way.

Happy inventorying!

~Jeff

If you want to get all of the files I've referenced here, you can download them all in one .zip file here.

Dude, where’s my SMS_SiteSystemToSQLConnection group?

jgilbert — Thu, 17 Jan 2008 22:42:00 GMT

A fairly common question I seem to keep running across from SMS 2003 admins that have upgraded to Configuration Manager is: "What happened to the SMS_SiteSystemToSQLConnection group on my Configuration Manager 2007 site database server?"

Although this is documented in the Configuration Manager documentation library in the What's New in Security for Configuration Manager topic, I figured that I would blog this to get the word out a little more.

In case you're wondering what that topic says, here's the applicable bit:

The SMS_SiteSystemToSQLConnection group is no longer needed because database access is controlled by SQL Server roles that are automatically created during Configuration Manager 2007 Setup. For more information, see About the Database Roles for Configuration Manager at http://technet.microsoft.com/en-us/library/bb632943.aspx.

So there you go...question answered

OK, you probably want a little more background information I'm guessing.

First, the history of the group. When SMS 2003 sites are installed, the SMS_SiteSystemToSQLConnection_<site code> group is created to manage the required permissions for site systems to access the site database to support advanced security. Site systems like management points, server locator points, and reporting points are thereafter added to this group when applicable-even if they're installed locally on the site server computer. You'll still see database roles installed on SQL 2005 instances hosting SMS 2003 site databases because database roles are a SQL 2005 feature, but you won't see SMS-related database roles as they're not used.

Now you see it (before upgrade from SMS 2003):

As stated earlier, Configuration Manager installations do not use the SMS_SiteSystemToSQLConnection_<site code> group so you won't find that group on the SQL Server hosting a Configuration Manager site database. Instead, SQL Server 2005 database roles are used to control site system access to the site database. All of the required database roles are created, and assigned the required permissions, during Configuration Manager primary site setup. Modifying the roles created by Configuration Manager 2007 and the permissions assigned to those roles is not supported

As new site systems are configured for the site that require access to the site database, site component manager automatically adds the computer account to the required database access roles for you-as long as you're using the computer$ for the site system to connect to the site database. If you will use a database connection account to allow a management point, PXE service point, or server locator point to connect to the site database, then you need to manually add the database connection account to the appropriate site database role.

Now you don't (after upgrading to Configuration Manager 2007):

For a picture of what these database roles look like (before and after upgrading to Configuration Manager) check out the picture at the bottom of my Upgrading SQL for SMS Sites post.

For more information about Configuration Manager database roles, see About the Database Roles for Configuration Manager.

Hope this helps,

~Jeff

Some great Configuration Manager Internet-based client support information

jgilbert — Wed, 16 Jan 2008 03:31:00 GMT

If you're interested in Configuration Manager native mode sites supporting Internet-based clients, you should definitely give this post a good read I think. It's an awesome post from Carol (our native mode/Internet-based client support writer (among other things)) on our writing team's blog:

http://blogs.technet.com/wemd_ua_-_sms_writing_team/archive/2008/01/15/tips-tricks-hints-for-native-mode-and-internet-based-client-management-part-1-of-3.aspx

~Jeff

How to format an external drive without losing the information stored on it

jgilbert — Fri, 11 Jan 2008 18:40:00 GMT

I generally format new USB drives NTFS as soon as I get them because for some reason they all still come formatted Fat32. You don't really notice this until you try to copy something large to them and then you get an error saying the file is too large for the file system.

I tried to copy a large virtual machine hard drive to one that I have that is already full of stuff today (I'm creating images for an MMS lab that will hopefully be approved!) and I got that error....#$%^&

I didn't want to format the entire drive and lose all of the information already on it, so I had to dig into my bag of tricks and use the DOS command Convert. This is actually a pretty fast process and saves the data already present on the drive-which is a plus. I converted a 80GB drive to NTFS in around five minutes.

To use this command, you just open a command prompt (if you're running Windows Vista you'll need to open the command prompt running as administrator) and convert away. You'll be prompted for the volume label of the drive to convert, so you need to know that as well.

It's a fairly simple process to convert the drive from FAT32 to NTFS using the CONVERT command and its syntax is shown below:

I think this is equivalent to the quick format option, I'm not positive, but I'll be reformatting this drive "the hard way" later just to make sure everything is copasetic in the future.

How to check the WMI repository before rebuilding it

jgilbert — Fri, 11 Jan 2008 01:30:00 GMT

I've had some WMI repository repair tidbits stashed away in my e-mail that I was going to blog about sooner or later. I'm not sure if today is sooner or later, but I did have to go looking through my old e-mails to find these steps for a lab machine today, and figured that was a sign I should finally post this information to the blog. If you suspect that the WMI repository has been corrupted, before throwing in the towel and blowing it away you can/should try to repair it

I couldn't remember where I got these command lines so I had to go look them up again! Looks like if the repository can't be repaired, it will be recreated anyway: http://www.microsoft.com/technet/scriptcenter/topics/help/wmi.mspx

Of course, you could use the WMI Diagnosis Utility to check for WMI corruption, but I'm a pretty impatient person at heart and find that this is just faster for me. The steps when using these commands go kind of like this--check it, fix it and worst case replace it.

Anyway, to check the WMI repository for errors on a Server 2003 SP1 or SP2 systems, run the following command from command prompt:

rundll32 wbemupgd, CheckWMISetup

Once you've run that command, check the setup.log file located at: %windir%\System32\Wbem\Logs\Setup.log. Check for entries from today's date. If you find none, then WMI is probably OK and you should continue troubleshooting somewhere else. If however, you see an error message from today saying that it can't find a namespace then yes, your WMI repository does have issues and you should do the below:

rundll32 wbemupgd, RepairWMISetup

This will re-create your WMI repository minus any custom .mof additions that were implemented without the -autorecover switch.

For Windows XP SP2, use the following command to check for corruption, and repair if necessary:

rundll32 wbemgupgd, UpgradeRepository

For Windows XP SP1, the check and repair commands are below and function just like the Windows Server 2003, SP1 commands:

rundll32 wbemupgd, CheckWMISetup

and

rundll32 wbemupgd, RepairWMISetup

Hope this helps,

~Jeff

Migrating Hardware Inventory Customizations When Upgrading to Configuration Manager 2007 from SMS 2003

jgilbert — Fri, 21 Dec 2007 22:59:00 GMT

In About MOF Files Used by Hardware Inventory, the behaviors of the Configuration.mof and SMS_def.mof Configuration Manager 2007 hardware inventory files are described. While that topic does say that the Configuration.mof is used for data classes, and the SMS_def.mof is used for reporting classes, some additional detail about how this affects you when you upgrade from SMS 2003 (and need to migrate existing hardware inventory customizations) could help out here.

(Before you ask, yes I'm going to update the docs with this information, but I won't be able to do that for a while so I'm posting this information here for now.)

If you've made hardware inventory modifications in SMS 2003 that you need to migrate--either in the SMS_def.mof or a "mini-mof" you'll need to separate the data classes from the reporting classes before adding them back in after the site upgrade has completed successfully. Before beginning the upgrade process, copy your SMS_def.mof or mini-mof to a new location so you can re-create the modifications after upgrading the site.

After upgrading the site, open up your mof file backup and copy the data class information to the bottom of the Configuration.mof (the Configuration.mof is located in the same directory as the SMS_def.mof file--.\inboxes\clifiles.src\hinv). Data classes contain the location and properties of the information stored on client computers that you want to inventory and are usually located in the root\cimv2, or some other, WMI namespace.

Next, copy the reporting class information into the bottom of the new SMS_def.mof created during the site upgrade process (reporting classes are always located in the root\cimv2\sms namespace).

Tip: When looking through the SMS_def.mof or mini-mof, you can see where WMI namespace changes are made by looking for lines like #pragma namespace root\cimv2 (data classes) or #pragma namespace root\cimv2\sms (reporting classes). Everything listed after a #pragma namespace line exists in the namespace designated in the change line.

If you're currently using a mini-mof with SMS 2003, then you're also probably using a #pragma include command to append the mini-mof data to the SMS_def.mof and client inventory policy created by the contents of the SMS_def.mof file. This works fine because the SMS_def.mof file is not actually sent to clients to compile, rather the contents of the SMS_def.mof file are turned into a policy compiled by clients. #pragma include commands are WMI commands and are recognized by the MOF file format and MOFCOMP.EXE--so it's not a function of SMS that allows you to use this command to append the contents of the mini-mof to the SMS_def.mof.

In Configuration Manager 2007, the Configuration.mof file itself is actually sent to clients as part of the client inventory policy body downloaded and compiled by clients. This means that any data that you need clients to compile must be defined in that file--so you can't use the #pragma include command to append a mini-mof file physically to the Configuration.mof. You can try, and data loader won't even blink because #pragma include commands are valid WMI commands and MOFCOMP.EXE will happily compile the updated file with no errors--the include command will just mean nothing to Configuration.mof behavior and will result in an invalid policy when clients evaluate it. In other words...you can do it, but it just won't work. If this happens, you'll need to dig through some policyagent.log files on clients to discover what happened and then go fix the Configuration.mof to get clients to perform proper hardware inventories with an updated, valid policy.

However, #pragma include still works in the Configuration Manager 2007 SMS_def.mof, because that functionality hasn't changed in Configuration Manager--the contents of the SMS_def.mof (whether physically in the file or logically appended to it using a mini-mof) are translated into an inventory policy automatically compiled by clients. This is a handy bit of information because now you know how to test hardware inventory modifications without adding them to the Configuration.mof and affecting all of your production clients. Just add the reporting classes to either the SMS_def.mof or append them via a mini-mof and then manually compile a data class .mof on a few test clients to see how things go (unless they're in the Configuration.mof, the custom data classes would still need to be manually compiled on clients just like SMS 2003 behavior).

With all that being said, I wouldn't personally use mini-mof files anymore in Configuration Manager. They don't work for the Configuration.mof and could lead to confusion later on in the SMS_def.mof. My recommendation here is to just add in customizations physically into the Configuration.mof or SMS_def.mof for Configuration Manager sites.

Problems searching .pst's with Outlook 2007?

jgilbert — Wed, 19 Dec 2007 20:31:00 GMT

I had the same issue initially, and fellow writer and myITforum'er Rob Stack showed me the light. For my setup, I had Office 2007 Enterprise edition installed on a Vista workstation.

If search in Vista and Outlook doesn't work for you, the following procedure should fix it.

1. Close all Office 2007 or Office 2003 applications.

2. Navigate to Control Panel - Programs and Features.

3. Right-click on Microsoft Office Enterprise 2007 and then click Change.

4. In the Microsoft Office Enterprise 2007 setup dialog box, select Repair and then click Continue.

5. The repair takes around 5 minutes, once it's complete, Navigate to Control Panel - Indexing Options.

6. In the Indexing Options dialog box, click Advanced.

7. Click Continue to get past the User Account Control dialog box.

8. In the Advanced Options dialog box, Click Rebuild to start rebuilding the Vista and office index.

9. Close all Dialog boxes.

Depending on how much you have on your disks and how much you have in your email, it could take quite a few hours to index all of your files.

How to Create the All Windows Vista Systems Collection the Easy Way

jgilbert — Fri, 14 Dec 2007 20:05:00 GMT

Some of you may have noticed that when you open up the Configuration Manager console, and view the default collections, that there isn't an All Windows Vista Systems collection there. There are some valid reasons for it not being there, but that's a different issue.

This post will help you create an All Windows Vista Systems collection the easy way.

There are a couple of ways to do this, but the easiest is to just copy the WQL query language from an existing collection. This is also how to easily recreate some of those collections that contain complex WQL queries when you only want to change one or two of the values.

For information on how to create collections using the "normal" method, see:

How to Create a Collection
http://technet.microsoft.com/en-us/library/bb694291.aspx

To get the party started, you need a WQL query from an existing collection based on an operating system value.

Note: To get to the collections node in the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management.

To get a collection WQL query based on an operating system value the easy way:

Right-click an existing collection based on operating system value and click Properties. For this example, I'm using the All Windows 2000 Systems collection.
With the Membership Rules Tab selected, click the Properties icon
Click Edit Query Statement...
Click Show Query Language and copy the WQL query into notepad
Cancel out of the collection properties without saving any changes.

With the trusty query now temporarily saved in notepad, you're ready to create the new collection for Vista systems:

Right-click Collections and click New Collection.
On the General Page of the New Collection Wizard, specify a name for the collection. For this example I'm using All Windows Vista Systems. You can name it whatever you want, but remember that collection names must be unique.
On the Membership Rules Page, you'll need to create a query to catch all of the Vista computers discovered:

Click the new query icon
Give it a cool name like All Windows Vista Systems or something
Click Edit Query Statement...
Click Show Query Language and copy the WQL query from notepad into it
Change the operating system version (at the end of the query) from 5.0 to 6.0

Click OK
Click OK
Click Next, Next, Next, Close.

Right-click, the new collection name and click Update Collection Membership, and OK on the collection update dialog box.

Viola! The Vista computers should appear-as long as you have some

Moving the SMS 2003 site database from SQL Server 2000 to a SQL Server 2005 remote database instance

jgilbert — Wed, 21 Nov 2007 16:50:00 GMT

In order to upgrade an SMS 2003 SP2 or SP3 site to Configuration Manager 2007 the site database must be at the SQL Server 2005 SP2 level. If you don't want to upgrade a SQL Server 2000 instance hosting a site database in-place, then you'll need to know how to move the site database to a new SQL 2005 default instance with SP2 installed.

/* Disclaimer time.

This is a fairly simple process, but as with everything, you should test and verify the process for yourself in a lab before moving on to your production environment. The steps I used in this posting were performed in a small lab environment to verify the steps. Remember, objects in the mirror are actually behind you and do not iron clothes on body.

Disclaimer time. */

So here's the site I'll be reconfiguring (APR) happily chugging away at the SMS 2003 SP2 level:

When you're sure that your existing SMS 2003 SP2, or above, site is functioning as expected, you're ready to move the site database. The first thing to do is to ensure that the SQL Server database collation is the same on the remote SQL Server as the one the site database is currently on. To check the SQL Server collation on the SQL Server 2000 instance, open up SQL Server Enterprise Manager and expand the console until the SQL Server instance the site database is hosted on is displayed. Right-click the SQL Server name and click Properties. Down at the bottom of the instance properties you can see the server collation setting:

Next, open up SQL Server Management Studio on the SQL 2005 server. Right click the default instance name (SMS 2003 site databases must be installed on the default instance) and click Properties. With General selected, look once again for the Server Collation setting:

If both of the servers are using the same collation, then you're ready to continue. If not, the easiest thing to do is reinstall SQL Server 2005 and ensure that the correct collation is selected during installation.

OK, now it's time to get down to business. Moving a site database is really a four step process:

Back up the site database on the SQL Server 2000 computer.
Restore the site database on the remote SQL Server 2005 computer.
Use SMS 2003 Setup to perform site maintenance to reconfigure the site to use the remote SQL Server 2005 computer to host the site database.
Reconnect Administrator consoles.

You'll notice that I didn't say anything about configuring SQL Server 2005 features for the site database-SMS 2003 doesn't use any SQL Server 2005 features so you don't need to perform any additional configuration.

Back up the site database on the SQL Server 2000 computer

Now that you've verified the remote SQL instance is using the same collation, the next step in moving the site database (whether you're going to a new version of SQL Server or not) is to get the site database on the remote SQL Server instance.

Begin by making a SQL Server backup of the site database. Before you can do that though, you'll need to close all administrator consoles connected to the site database and stop the following site server services. These are the same services stopped during the normal SMS 2003 site backup maintenance task:

SMS_EXECUTIVE
SMS_SITE_COMPONENT_MANAGER
SMS_SQL_MONITOR
Tip: If the site database is already on a remote SQL Server, then this service will be installed on the remote SQL Server computer and named SMS_SQL_MONITOR_<site server name>.
Tip for the Tip: If you're looking for this service in a Configuration Manager installation, stop-that service has been incorporated as a thread of the SMS_EXECUTIVE service in Configuration Manager.

You can use a command prompt to stop these services using net stop commands like: net stop sms_executive and so on.

With all database connections effectively stopped, you're ready to create the database backup from within SQL Server Enterprise Manager:

Right-click the site database name, click All Tasks, and then Backup Database...
On the SQL Server Backup - <site database name> General tab, ensure that the site database is selected in the Database field, type a friendly name for the database backup in the Name field and optionally a description.
Leave the option to create a complete database backup enabled.
If you've enabled the backup site server maintenance task, the backup destination location displayed will be set to the Backup SMS Site Server maintenance task backup location setting. Highlight it and click Remove (don't worry the next time the site backup task starts, it will reset the backup destination location).
Click Add. Enter a path to an existing directory to store the database backup and a name for the backup file with a .BAK extension. For example, if you want to store the database backup in D:\SQLBackup and name the backup file backup.bak, your file name would be: D:\SQLBackup\backup.bak.
Enable the Overwrite existing media option just in case there is already a backup at the backup destination.
Now click over to the Options tab and select the Verify backup upon completion option and click OK to get the party started. If all goes well, you should see a dialog box similar to the following:
After the database backup has completed, you can close SQL Server Enterprise Manager.
Using Windows Explorer, browse to the backup destination location and find the database backup you just created.
Copy the backup file (bak) to the remote SQL 2005 Server.
Restart the site server computer.

Restore the site database on the remote SQL Server 2005 computer.

On the remote SQL Server 2005 server, open up SQL Server Management Studio for the default instance, right-click Databases and then click Restore Database...
On the Restore Database General page, type the name of the site database in the To database: field (SMS_APR in this example). Select the From device: option, click the browse button (...) and click Add.
Browse to the location of the site database backup file (.bak) copied from the SQL Server 2000 computer and click OK, and OK again to close the Specify Backup dialog.
In the Select the backup sets to restore section, check the Restore option next to the site database backup and click OK. Viola!

Use SMS 2003 Setup to perform site maintenance to reconfigure the site to use the remote SQL Server 2005 computer to host the site database

On the primary site server computer, start SMS 2003 Setup from the start menu.
On the Setup Options page, select Modify or reset the current installation and click Next.
On the Database Modification page, type the name of the remote SQL 2005 Server you restored the database backup to and verify that the database name is correct.
Continue through Setup and click Finish to begin the site database setting reconfiguration process. If all goes well, you should see something like:

Reconnect the Administrator consoles

At this point, when you open the Administrator console for the site it will fail to connect to the site database. This is because it's still looking for the old site database and the site server says nope, it's not there anymore. To reconnect the Administrator console to the new site database server, you need to use the Site Database Connection Wizard.

From within the Administrator console, right-click on the failed connection and click Delete.
Right click Systems Management Server at the top of the console and click All Tasks, Connect to Site Database to start the Site Database Connection Wizard.
On the Locate Site Database page, select the primary site server computer name-not the remote SQL Server name-click Next and finish the wizard.
The Administrator console should be successfully connected to the new site database at this point.
Just to verify the move was successful, you can expand the console and view the site systems for the site. The remote SQL Server computer should now be listed as the SMS SQL Server component role.

So there you go, that's it :-)

~Jeff

Upgrading SQL for SMS Sites

jgilbert — Sat, 17 Nov 2007 18:13:00 GMT

In order to upgrade an SMS 2003 SP2 or SP3 site to Configuration Manager 2007 the site database must be at the SQL Server 2005 SP2 level. Upgrading SQL Server can be a daunting prospect for a lot of SMS administrators out there, but have no fear you don't need a DBA to do this for you and the process is probably a lot easier than you think. If you don't want to upgrade SQL Server in-place, you can always move the site database to a remote SQL Server 2005 SP2 instance instead.

/* Disclaimer time.

Sure I said it's easy, but don't take that to mean you shouldn't test and verify the process for yourself in a lab before moving on to your production environment. The steps I used to upgrade the site database in this posting were performed in a small lab environment to verify the steps. Your mileage may vary and this process may cause drowsiness.

Disclaimer time. */

If you're going to do this in a lab, then the first thing you need is a fully functional SMS 2003 site with at least SP2 installed. Clients should be installed and some basic site configuration done (inventory, software dist, etc...) to verify that the site is ready for upgrade. There's nothing more annoying that wondering why your site doesn't work correctly after upgrading and then discovering that it wasn't working before the upgrade either and you just wasted hours trying to troubleshoot an upgrade problem that didn't exist!

So here's the site I'll be upgrading (APR) happily chugging away at the SMS 2003 SP2 level:

And here are the steps to upgrade the site database server to SQL 2005 SP2 from SQL 2000 SP4:

Back up the site using the integrated SMS 2003 backup site server maintenance task. If you don't want to wait for the scheduled backup time, you can start the process from the command line. From a command prompt type net start SMS_SITE_BACKUP and then watch the smsbkup.log to ensure that the site is successfully backed up (better safe than sorry in case something goes wrong).
Stop the following SMS services. You can do this from a command prompt using net stop commands as well, ‘i.e.' net stop SMS_EXECUTIVE and so on. Technically, you could just disable these until you've finished upgrading SQL, but I think it's fun to play with the command prompt (may DOS never die!!!) and since I know I'm toying with the database, any odd status messages telling me that the site can't communicate with the database during this process (between steps 5 and 6) won't concern me. Anyway, these are the same services stopped during the normal SMS site backup maintenance task so go ahead and stop ‘em before proceeding:

SMS_EXECUTIVE
SMS_SITE_COMPONENT_MANAGER
SMS_SQL_MONITOR

Now that the SMS site installation has effectively given the site database "the hand" and won't be interfering with the SQL business, use the SQL Server backup task and back the database up from within SQL Server. Why? A straight SQL Server backup can not be used to fully restore a failed site, but it can be used to restore a failed site database or be used to move the site database to a remote SQL Server installation.
Run SQL 2005 Setup to upgrade the database components and optionally install SQL 2005 workstation components. Remember, the same SQL Server edition already installed must be used to upgrade the SQL instance. For example, you can't go from Standard to Enterprise during an upgrade. SMS isn't really concerned with the edition of SQL anyway; it will run on either just as well.
After SQL has been upgraded, restart the server.
Now, go back and repeat step 2 to stop those same services again before moving on to step 7.
Run the SQL 2005 SP2 installation to upgrade the SQL Server instance to SP2.
After SQL has been upgraded again, restart the server again.
Open the admin console to verify that everything is as happy as it was before you started this process. Oh yeah, if you disabled the services at step 2, make sure you enable them again!

That's it! You don't need to worry about setting any additional SQL Server settings like setting the SQL Server compatibility level to 90 (SQL Server 2005 default) for the site database because SMS 2003 doesn't use any SQL 2005 features and is perfectly happy with the site compatibility level at 80 (SQL Server 2000 default) and that's what the site database will be set to use after upgrading SQL.

To see the compatibility level the database is using, you can right-click the database name, click Properties, and then click Options:

Unlike SMS 2003, Configuration Manager does take advantage of SQL Server 2005 database features. For Configuration Manager site databases, the compatibility level must be set to 90 and some additional configuration changes made to the upgraded site database. Don't worry though, Configuration Manager Setup takes care of all the database configuration changes for you during the upgrade process.

After upgrading to Configuration Manager from SMS 2003, the site database will be configured to operate using the compatibility level of 90.

One of the SQL Server 2005 features that Configuration Manager uses are database roles. All of the smsdbrole_* database roles are created and populated with the appropriate site systems during the site upgrade process. These SQL Server database roles are used for securing remote site system access to the site database instead of the SMS_SiteSystemToSQLConnection_<site code> group used in SMS 2003.

See the new roles?

So that's it in a nutshell. Happy upgrading :-)

~Jeff

Searching the Configuration Manager documentation online

jgilbert — Wed, 07 Nov 2007 18:47:00 GMT

Here's the easy way to search the online version of the Configuration Manager documentation:

You can read more about it on the writer's blog by clicking here.

~Jeff

You can rate the docs online now!

jgilbert — Sun, 04 Nov 2007 18:03:00 GMT

I've just posted on the writers' blog about rating the online documentation for Configuration Manager. Instead of re-posting it here, I figured that I would just give the link:

http://blogs.technet.com/wemd_ua_-_sms_writing_team/archive/2007/11/01/rate-the-docs.aspx

Help us help you!!!

~Jeff