Niall C. Brady at myITforum.com

moving my blog to niallbrady.com

2012-03-07T09:35:00Z

After just over two years of blogging here on MyItforum, i've decided to move my blog to my own domain name located here. It should be easy enough to remember, so if you want to keep reading my stuff then change your bookmarks to:-

www.niallbrady.com

cheers !

niall

Customising Windows 7 deployments - Part 6. Adding multiple keyboard layouts and multiple languages

2012-03-06T22:38:00Z

This post is an addition to Part 4 where we installed Language packs on a one-by-one basis (i.e. one language pack selected, one installed, one keyboard layout selected, one installed). What if you want to install multiple Language packs and multiple Keyboard Layouts well this is how to do it...but before we continue, make sure you have successfully completed Part 4 before attempting this.

To make this possible I adapted the windows-noob.com Multipurpose FrontEnd HTA so that i could select Multiple languages and Multiple Keyboard Layouts, this change is only a minor one to both the backend script (HTA) and the task sequence itself, so rather than explain all about them i&#39;ll post this bits you need to know here. Also, I havn&#39;t ported these changes yet *but will soon* into the BitLocker Frontend HTA which I think looks much cooler, so i&#39;ll hope that you check that one out also. So where do we start, with the actual frontend HTA backend code.. aka, the hta itself.

the folliowing section has been changed in the Deploymenu.HTA file,

        <tr>
                <td class="taskTableLeftCell" >Regional Settings</td>
                <td colspan="3" class="taskTableSpanSecondAndThirdCell">
                <select name="regionDropDown" id="regionDropDown">
                                        <option value="None">None</option>
                                        <option value="Multi">Multi</option>
                                        <option value="En-US">En-US</option>
                                        <option value="sv-SE">sv-SE</option>
                                        <option value="da-DK">da-DK</option>
                                        <option value="nb-NO">nb-NO</option>
                                        <option value="fi-FI">fi-FI</option>
                </select>
                        </td>
                </tr>
                <tr>
                        <td class="taskTableLeftCell" >Language Settings</td>
                <td colspan="3" class="taskTableSpanSecondAndThirdCell">
                <select name="languageDropDown" id="languageDropDown">
                                        <option value="None">None</option>
                                        <option value="Multi">Multi</option>
                                        <option value="English">English</option>
                                        <option value="Swedish">Swedish</option>
                                        <option value="Danish">Danish</option>
                                        <option value="Norwegian">Norwegian</option>
                                        <option value="Finnish">Finnish</option>
                </select>
                </td>
        </tr>

the new bits in both drop down menus (regional/language) are this

                                        <option value="None">None</option>
                                        <option value="Multi">Multi</option>

and they offer us the ability to set nothing (and get the default en-US/English) or to select Multi or to select ONE language or ONE keyboard layout. The MULTI option is special. It simply sets a variable which will run a group of steps to select multiple languages and/or keyboard layouts in the task sequence. The screenshot below shows both Regional (keyboard layout) and Language options have been set to Multi via the drop down menu.

Setting the Regional options

If we select Multi for Regional options then the following group is run in the task sequence

the Options tab is where it detects the RegionValue variable value and if it equals Multi this group is executed

the first step of the group sets the OSDInputLocale variable and&nbsp;&nbsp;it sets the Default keyboard layout (the first one listed) and the remaining available keyboards added to windows

the values in that step are as follows

en-US;0409:00000409;da-DK;0406:00000406;fi-FI;040b:0000040b;sv-SE;041d:0000041d;nb-NO;0414:00000414

the remaining steps of this group simply set OSDSystemLocale and OSDUserLocale to be equal to en-US.

Setting the Language options

The first step of this group (which only runs if the LanguageValue variable=Multi) is to set the OSDUILanguage, I set it to en-US.

The next step installs the Language pack offline. The only magic here is in the language package, it must contain ALL of the language packs you intend to install as part of your Multi Language installation, so in my example I install 4 languages,

Swedish
Danish
Finnish
Norwegian

and all those language packs are in my Offline Nordic Language Pack. Your multi language pack could contain however many languages you intend to install as a group, but the more you add the longer the install will take.

What is the result ?

so what do you get when it&#39;s all done ? you get&nbsp;&nbsp;the ability to use a drop down keyboard selector on the Windows 7 login screen

and you can choose the same keyboard layouts within Windows

jod done, i'd say :-)

Download the goodies

Here's the updated task sequence and HTA files,you dont have to use a HTA to set the variables you can do that via collection variables or some other method but doing it in a HTA is cool. People will like you more.

DeployMenu.zip (13.69K)
Number of downloads: 0

have fun !
cheers
niall

original post here on windows-nooob

using SCCM 2012 RC in a LAB - Part 16. Integrating MDT 2012 RC1 with Configuration Manager 2012

2012-03-01T21:46:00Z

In Part 1 of this series we got our AD and SCCM servers ready, and then we installed System Center 2012 Configuration Manager as a standalone Primary site. In Part 2 we configured the SCCM server further by adding some Windows Server roles necessary for the following Configuration Manager 2012 functionality, Software Update Point (SUP) and Operating System Deployment. In Part 3 we configured the server further by Enabling Discovery methods and creating Boundary's and Boundary Groups. In Part 4 we configured Client Settings, Added roles and Distributed the Configmgr Client to our Computers within the LAB, then in Part 5 we enabled the Endpoint Protection Role and configured Endpoint Protection settings and targeted a collection called All Windows 7 Computers with these settings and policies.

In Part 6 we configured our SUP further to Deploy software updates to our All Windows 7 Computers and Build Windows 7 X64 collections. In Part 7 we used the Build and Capture process to create our Base Windows 7 X64 wim image. In Part 8 we created a USMT 4 package to migrate the users data using hardlinking and then we imported the captured image into ConfigMgr and created a Deploy Windows 7 X64 task sequence. We created a Deploy Windows 7 X64 Collection and set some User Device Affinity collection variables.

In Part 9 we created an Application, and created a deployment type for that application to only install if the Primary User was True for that device (User Device Affinity), we then copied our Task Sequence (duplicated it), deployed the new Task Sequence, added a computer to the new collection and then PXE booted the computer to the Deployment Menu. In Part 10 we monitored the Deployment process in a lot of detail to how UDA sent state messages and we verified that our application installed on the users Primary Device, in addition we modified our collection variables, and added a prestart command to our boot image to prompt for the SMSTSUdaUsers. In Part 11 we setup the Reporting Services Point Role and verified that reporting was working.

In Part 12 we demonstrated a new feature in ConfigMgr which allows us to Patch operating system WIM images using Offline Servicing. This means that you can apply Windows Updates by using Component-Based Servicing (CBS) to update the your previously captured WIM images. In Part 13 we looked at how Role Based Administration is used within ConfigMgr and we created a new custom role to allow a user (or users within a Security Group) to view Software Update Reports. This is useful because you will probably want one team to take care of configuring and deploying software updates, and to grant another (Management etc) the capability of reviewing Compliance Reports. In Part 14 we performed a side-by-side migration from Configuration Manager 2007.

In Part 15, we deployed Windows 8 Consumer Preview to see if it was possible, and indeed it was (it's not supported by Microsoft however). Now we will integrate the recently released MDT 2012 RC1 with Configuration Manager to avail of new features (features and enhancements which can help to make large-scale desktop and server deployments smoother than ever) that it provides through MDT Integration. Having MDT integrated with ConfigMgr will give you lots of benefits and abilities so I would definitely recommend you integrate it. Note that in order to download this build of MDT you have to be registered with the MDT program on Connect.

Quote

Support for Configuration Manager 2012 RC2: This update provides support for Configuration Manager 2012 RC2 releases. MDT 2012 fully leverages the capabilities provided by Configuration Manager 2012 for OS deployment. The latest version of MDT offers new User-Driven Installation components and extensibility for Configuration Manager 2007 and 2012. Users now also have the ability to migrate MDT 2012 task sequences from Configuration Manager 2007 to Configuration Manager 2012.

Step 1. Download MDT 2012 RC1 and Install it.
Note: Perform the following on the ConfigMgr 2012 server as SMSadmin

MDT 2012 RC1 is available for Microsoft Connect customers from the following location. As we are using Server 2008 R2 (64bit OS) we will download and install the 64 bit version of the software (MicrosoftDeploymentToolkit2012_x64.msi). Note that the connect site requires a Microsoft Live Id to login. If your ConfigMgr console is open, close it and then install the MSI by right clicking on the downloaded MSI file and choose Install.

when the open file security window appears choose Run

the Welcome to MDT wizard appears, click next

accept the EULA if you want to continue and click next

and next you get to choose where you want to isntall MDT, we will install it on D:\Program Files\Microsoft Deployment Toolkit\ so set your path accordingly

click next, and then click Install

answer yes to the UAC prompt

and finally it's installed by clicking Finish.

Step 2. Integrating MDT with Configuration Manager
Note: Perform the following on the ConfigMgr 2012 server as SMSadmin

Now that you have installed MDT you want to integrate it (Configure ConfigMgr Integration) with ConfigMgr. We do this to gain access to tools and features that MDT provides from within the ConfigMgr console.

In the start menu, locate the newly installed Microsoft Deployment Toolkit application and expand it, locate the Configure ConfigMgr Integration shortcut and right click, choose Run as Administrator.

click yes when prompted by UAC

review the pre-populated options and click next

and review the Confirmation, make sure there are no issues reported otherwise your MDT Integration has failed

Step 3. Create a MDT Task Sequence in ConfigMgr
Note: Perform the following on the ConfigMgr 2012 server as SMSadmin

As we need the some MDT components such as MDT Boot image, MDT Toolkit Files and MDT Settings packages created, we will go through creating an MDT Task Sequence. Start up the ConfigMgr console and browse to Software Library, Operating Systems, right click on Task Sequences and choose Create MDT Task Sequence.

Choose a Template, there are several provided in the drop down menu, we will choose Client Task sequence

fill in the Task Sequence name and comments

for Details, fill in your Domain Join credentials

We are not going to catpure an image with this Task Sequence, as we are only using this Task Sequence to create the needed MDT Files and Settings packages...

for boot image, specify a previously created (empty folder) UNC path, eg: \\sccm\sources\os\boot\mdt\i386

fill in some MDT boot image details

and for options specify the X86 architecture and set your scratch space (environment for MDT to use in WinPE) to 128MB (to allow drivers etc...)

next select your optional WinPE components (language, MDAC/ADO support and PPoE)

and fill in your prestart, extrafiles and wallpaper options (all optional), make sure to leave F8 command prompt selected

Next we get to create our MDT Toolkit Files package, so select the Create a new Microsoft Deployment Toolkit Files package option, point it to a previously created path such as \\sccm\sources\os\mdt\2012_rc1\files

fill in details about the MDT Toolkit Files package..be descriptive as it's common to have different versions of MDT Files in your lab (in the future)

for OS Image, specify an exiting image, select the Windows 7 X64 image we captured in part 7

and then select our previously created Configuration Manager Client Package

and our previously created USMT 4 package

for the Settings Package, we choose to create a new Microsoft Deployment Toolkit Settings Package, point it to \\sccm\sources\os\mdt\2012_rc1\settings

fill in the Settings Package details

choose No Sysprep package and click next through the summary to Confirmation, answer Yes to any UAC prompt that may appear, at this point you can go take a long coffee break as this takes quite some time to mount the WIM image (boot) and create the packages and do it's magic..

and finally it's done !

Step 4. Distribute your new MDT packages and boot image to your distribution points
Note: Perform the following on the ConfigMgr 2012 server as SMSadmin

At this point, i'm sure we are all aware how to distribute content in ConfigMgr, and now we have some new packages (MDT Files, MDT Settings) and a new MDT boot image to distribute to our dp's.

I'll show you how to distribute one of these, you can do the rest.

Select the MDT Settings package in Software Library, Packages, right click it and choose Distribute Content

select your distribution point(s)

and continue through the wizard..

Note: Please don't forget to repeat the above process for the MDT Files, and the MDT boot image.

In the next part of this series we'll look at what we can do with MDT within ConfigMgr.

The original post is here on windows-noob.

Using SCCM 2012 RC in a LAB - Part 15. Deploying Windows 8 Consumer Preview using Configuration Manager 2012 RC2

2012-02-29T20:12:00Z

In Part 1 of this series we got our AD and SCCM servers ready, and then we installed System Center 2012 Configuration Manager as a standalone Primary site. In Part 2 we configured the SCCM server further by adding some Windows Server roles necessary for the following Configuration Manager 2012 functionality, Software Update Point (SUP) and Operating System Deployment. In Part 3 we configured the server further by Enabling Discovery methods and creating Boundary's and Boundary Groups. In Part 4 we configured Client Settings, Added roles and Distributed the Configmgr Client to our Computers within the LAB, then in Part 5 we enabled the Endpoint Protection Role and configured Endpoint Protection settings and targeted a collection called All Windows 7 Computers with these settings and policies.

In Part 6 we configured our SUP further to Deploy software updates to our All Windows 7 Computers and Build Windows 7 X64 collections. In Part 7 we used the Build and Capture process to create our Base Windows 7 X64 wim image. In Part 8 we created a USMT 4 package to migrate the users data using hardlinking and then we imported the captured image into ConfigMgr and created a Deploy Windows 7 X64 task sequence. We created a Deploy Windows 7 X64 Collection and set some User Device Affinity collection variables.

In Part 9 we created an Application, and created a deployment type for that application to only install if the Primary User was True for that device (User Device Affinity), we then copied our Task Sequence (duplicated it), deployed the new Task Sequence, added a computer to the new collection and then PXE booted the computer to the Deployment Menu. In Part 10 we monitored the Deployment process in a lot of detail to how UDA sent state messages and we verified that our application installed on the users Primary Device, in addition we modified our collection variables, and added a prestart command to our boot image to prompt for the SMSTSUdaUsers. In Part 11 we setup the Reporting Services Point Role and verified that reporting was working.

In Part 12 we demonstrated a new feature in ConfigMgr which allows us to Patch operating system WIM images using Offline Servicing. This means that you can apply Windows Updates by using Component-Based Servicing (CBS) to update the your previously captured WIM images. In Part 13 we looked at how Role Based Administration is used within ConfigMgr and we created a new custom role to allow a user (or users within a Security Group) to view Software Update Reports. This is useful because you will probably want one team to take care of configuring and deploying software updates, and to grant another (Management etc) the capability of reviewing Compliance Reports. In Part 14 we performed a side-by-side migration from Configuration Manager 2007.

Now we will test deploying Windows 8 Consumer Preview.

Note: This is a Windows 8 Consumer Preview OS being installed using a release candidate product so your results may vary and of course it's not supported by Microsoft. I'm only doing this because I want to see if it's possible to deploy Windows 8 with the current release of Configuration Manager 2012 and of course it's fun :-)

Windows 8 Consumer Preview System Requirements

Windows 8 Consumer Preview works great on the same hardware that powers Windows 7:

Processor: 1 gigahertz (GHz) or faster
RAM: 1 gigabyte (GB) (32-bit) or 2 GB (64-bit)
Hard disk space: 16 GB (32-bit) or 20 GB (64-bit)
Graphics card: Microsoft DirectX 9 graphics device or higher
To use touch, you need a tablet or monitor that supports multitouch
To access Windows Store and to download and run apps, you need an active Internet connection and a screen resolution of at least 1024 x 768
To snap apps, you need a screen resolution of at least 1366 x 768

Step 1. Get the ISO and Extract the contents on your Configuration Manager 2012 server

Download Windows 8 Consumer Preview from here, I used the X86 ISO (Windows8-ConsumerPreview-32bit-English.iso) for my Guide.
I then Mounted that ISO in my Configuration Manager 2012 RC 2 Hyperv virtual Machine and extracted the contents to \\sccm\sources\os\Windows 8 X86 Beta

Step 2. Add the Operating System Installer Image and Distribute Content

In the Configmgr Console, expand Software Library, Operating Systems, Operating System Installers, right click and choose Add Operating System Installer

browse to the path where we extracted it in Step 1

fill in some details about the image

and click next through to the summary

Once added, distribute the content to your DP's by right clicking the image and choose Distribute Content.

and continue through the wizard just like you've done before with Windows 7's installer image.

Step 3. Create the Build and Capture Task Sequence

In task sequences, right click and choose Create Task Sequence

Choose the Build and Capture a reference operating system image option

fill in the details and choose a X86 boot image as we are Build and Capturing the X86 Windows 8 image...

Note: if you are trying with the X64 image, then use a X64 boot image.

for the Install Windows step, select the following options, for Product key, use the key listed here otherwise the Setup Windows and Configmgr step will fail (error 31) later on in the process.

for network select to join a workgroup

select your Configmgr Client in the next step then next your way through on to the Capture image step, fill in your capture details

click next through to summary

Now right click the task sequence and choose Edit, Disable the Entire Capture Group (for now) and also disable the apply device drivers step.

Step 4. Deploy the Build and Capture Task Sequence

Right click on the task sequence and choose Deploy,

point it to the All Systems Collection (this is a LAB so this is OK, don't deploy task sequences to All Systems in production please....)

make sure it's set to Available and enable PXE

click your way through to completion of the wizard..

Step 5. PXE boot a new virtual machine and start the process

PXE boot your Virtual Machine (create a new one in hyperV), Press F12 for Network boot then you'll see the now familiar and very nice Configuration Manager 2012 splash screen

select your Build and Capture Task sequence and press enter, it starts applying the OS

and the Operating System installation starts..notice the color scheme is slightly different to what we are used to, and I like it !

before it reboots it might be an idea to monitor the SMSTS.log file using cmtrace

and after the first reboot we get our first look at Windows 8 Consumer Preview setting up :-)

and another reboot takes place..before Windows 8 finalizes settings

and then Setup Windows and ConfigMgr does it's work..

and we are done !

Conclusion: ConfigMgr rocks, and Windows 8 Consumer Preview rocks !!

more screenshots coming soon when bandwidth allows...currently it's worse than 56k dialup !!!

The original post is here on windows-noob.

Invalid character in unattend.xml file causing Windows 7 Service Pack 1 Offline Language Pack installation failure

2012-02-24T10:51:00Z

I came across this problem yesterday and after troubleshooting it for a few hours (initially thought it was related to a language pack package versioning issue) the eureka moment arrived, all thanks to reading the logs on the client. First of all let me describe the issue, it was a fairly standard task sequence to install Windows 7 Enterprise X86 Service Pack 1 with Offline Language Packs and it was failing just after the setup windows and configmgr step (after the first reboot) during windows setup.

So what error did the customer see ? When they applied the language pack offline step, the Setup Windows and Configmgr step would restart the computer into Windows Setup and at this point shortly after, the installation would fail with the following error message

Windows setup encountered an internal error while loading or searching for an unattend answer file

As this was a language pack installation, and as the failure only started happening when the customer added language packs I presumed that there was something wrong with either:-

The unattend.xml file used
The language pack
The steps in the task sequence used for installing the Language Pack

The unattend.xml File

So I set about determining what was causing the actual issue. First of all I needed to rule out the unattend.xml file itself which is specified in the Apply Operating System Step (needed so that the offline language package variables values can be injected), by replacing it with a known good one, stragely though I got the same error, the language pack was failing to install and windows setup was failing.

As part of this troubleshooting I used a technique called pausing the task sequence to review logs/files before and after steps were taking place. I'd highly recommend you try pausing your task sequence if you are having issues debugging it. I would pause the task sequence and verify that the unattend.xml file was in the right place, it was present in c:\windows\panther\unattend\unattend.xml and it looked correct.

Anyway, what I noticed from using a known good XML file was that the following error was present in the BDD_pkgmgr.log.txt logfile.

Quote

2012-02-24 14:15:31, Error DISM DISM Unattend Manager: PID=1800 Failed to parse the unattended answer file. - CUnattendManager::Validate(hr:0x800705b9)
2012-02-24 14:15:31, Error DISM DISM Unattend Manager: PID=1800 d:\w7rtm\base\ntsetup\opktools\dism\providers\unattendprovider\dll\unattendmanager.cpp:374 - CUnattendManager::Apply(hr:0x800705b9)
2012-02-24 14:15:31, Error DISM DISM Unattend Manager: PID=1800 d:\w7rtm\base\ntsetup\opktools\dism\providers\unattendprovider\dll\unattendmanager.cpp:654 - CUnattendManager::InternalExecuteCmdLine(hr:0x800705b9)
2012-02-24 14:15:31, Error DISM DISM Unattend Manager: PID=1800 d:\w7rtm\base\ntsetup\opktools\dism\providers\unattendprovider\dll\unattendmanager.cpp:603 - CUnattendManager::ExecuteCmdLine(hr:0x800705b9)

followed shortly after by

Quote

2012-02-24 14:15:31, Info CBS Dism.exe returned: 1465

which told me that DISM was failing to inject the offline language pack and was having issues with parsing the unattended answer file, but didn't tell me why....

But I was using a known good unattend.xml file so what could possibly be wrong, were the logs lieing to me, it didn't make sense as the unattend.xml file looked fine, even after the Setup Windows and configMgr step, so something else must be wrong, right ?

The language pack

The next test I did was to rule out the Install Language Pack step itself, so I disabled that step (the group actually) and the installation of Windows 7 continued without any problems at all. Great, it must be the language pack ! The image the customer was deploying was Windows 7 Enterprise X86 Service Pack 1, so I made sure they downloaded the language pack files for that version of Windows, yes there are language pack files for both X86 and X64 so I wanted to be sure they were using the right ones, In addition, I recreated the language package used in the deployment task sequence, redistributed it to the distribution points and added that new package into the task sequence. I started another installation and noticed that the Apply Language Pack offline step was running through very quickly, normally when installing a language pack it takes some time to complete, this is an indication that something is wrong. Once again, dism pointed to the exact same failure as noted above, ok, i've ruled out the customers Unattend.xml file, I've ruled out the Language pack what else could it be.

The steps in the task sequence

Finally I looked very closely at each step in the task sequence involved in the Language pack installation, I examined each of the Set Task Sequence variable steps and made sure they were correct and that they were in the correct sequence and indeed that these steps were occuring after Apply windows settings, apply network settings but before Setup Windows and configMgr, they were all fine... and in the right place.

This didn't make sense I must have missed something, so I set about reading all of the logs once again to try and determine what was going wrong.

Reading the Logs

I initiated another installation and paused the task sequence just before Setup Windows and configMgr, I brought up a command prompt and browsed to C:\_SMSTaskSequence in there were all the logs I needed.

The first Log to look at was the SMSTS.log file, normally i'll look for the word failed or in Trace32.exe search for any red lines (indicating an error).

Neither helped.. nothing jumped out at me.

so then I opened the ZTIPatches.log file (this file is used to log information when installing updates or language packs offline) and it was there I had the Eureka moment

Quote

line 18 an invalid character was found in text content. <RegisteredOrganization>

huh ? could this be true, ok I opened the Unattend.XML file that the customer had and Registered Organization was not present, so I started another installation and opened the c:\windows\panther\unattend\unattend.xml file that was present, still no Registered Organization, so i let the installation continue right up until the Setup Windows and configMgr step and at this point the unattend.xml file DID have the Registered Organization field present, infact, it's added in the Apply Windows Settings step. And what I saw was the Eureka moment, the Registered Organization had a Swedish character present in it's name, i'm not going to name that company but I will show you what it could look like here

so that was it !, I changed the Registered Organization name, by removing the Swedish characters and replacing them with standard 'o's and the problem was resolved and DISM worked correctly and the language packs got installed. Basically what this meant was that DISM wanted to interpret the unattend.xml file in order to know what it had to inject into the offline image, it couldn't understand the unattend.xml file due to the Swedish characters being present and therefore bombed out of what it was doing with a parse error message. Replacing the Registered Organization name with one that contained only English characters allowed DISM to work correctly and all was good. The log files really don't lie !

I wanted to post this incase any of you run into the same issue..

The moral of the story:-

If you are using Offline Language Packs and they are failing to install, verify the following logs for any details that will give you a clue to the issue.

SMSTS.log
ZTIPatches.log
BDD_PKGMGR.log.txt

Oh and if you are in a European country that uses Non-English alphabetical characters be sure to check the Registered Organization field in your Apply Windows Settings Step and if necessary remove any strange characters if they are complained about in your ZTIpatches or SMSTS.log file.

cheers
niall

The original post is here on windows-noob

How can I capture an image using capture media in ConfigMgr 2012

2012-02-21T17:08:00Z

You may want to capture an image of a manually installed computer and Configuration Manager 2012 provides a method of doing just that called Capture Media. This media is created as an ISO file which you burn directly to cd/DVD or mount in a virtual machine and use. But first you need to make sure that the image you want to capture is in the right state, and that state is in a Workgroup, In other words, the machine you want to capture the image from must not be joined to a domain, if it is then remove it from the domain (join a workgroup). In addition, you must have installed the Configuration Manager client on this computer before removing it from the domain.

Step 1. Join a Workgroup

Perform the following on the computer which you want to capture an image of as a local administrator.

Click on Start, Right click on Computer, choose properties, click on change settings to the right of the Computername

click on Change

type in the name of a workgroup to join and click ok

click ok to accept the computer name domain change

you'll be welcomed to the windows-noob workgroup, click ok

and you'll be told to restart, so restart..click ok to restart

Step 2. Create the Capture Media

Perform the following on the Configuration Manager server as a SMSadmin.

Open the ConfigMgr console, click on Software Library, Operating Systems, expand Task Sequences. In the ribbon click on Create Task Sequence Media

when the Create Task Sequence Media wizard appears click on Capture Media

click next and browse to the path of where you want to store the ISO file, give it a name like capture_media.iso

click next, then click on browse beside boot image

select your X86 boot image

click ok, then click on Browse beside Distribution Point

select your distribution point

now your selected boot image and distribution point are listed, click next to continue through the wizard

if you get a UAC prompt accept it

finally the media is done !

if you need to troubleshoot it's creation look at the CreateTSMedia.log file in your confmgr LOGS dir. (D:\Program Files\Microsoft Configuration Manager\AdminConsole\AdminUILog)

Step 3. While in Windows, start the ISO/CD/DVD on the Workgroup Computer

Perform the following on the computer which you want to capture an image of as a local administrator.

if you are using virtual hardware (hyperv or vmware) just mount the ISO on your workgroup computer (click on Media, Insert Disc, browse to the ISO location), otherwise burn the ISO to cd/dvd and insert that burned cd/dvd into the computer you need to capture.

While still in Windows (do not try to boot from this ISO/CD/DVD) you should see the following

click on Run TSMBAutorun.exe

Welcome to the Image Capture Wizard appears, click next..

Enter a path and name for the WIM file, I chose \\sccm\sources\os\captures\captured.wim and then enter the credentials of a user with permissions to write to that location

enter some Image Information

review the summary

and click finish to start the capture process, notice how it prepares the config manager client

and then it syspreps

before rebooting into Windows PE to capture the system

and the capture begins !

success !

The original post is here on windows-noob

How can I setup a Distribution Point in ConfigMgr 2012 on a Windows 7 computer?

2012-02-18T09:52:00Z

In this guide we will troubleshoot the installation of the distribution point role on a Windows 7 X64 computer, we presume that you have added the Windows 7 computer as a new site system server by doing as follows on your Configuration Manager server.

In the Configuration Manager console, click Administration.
In the Administration workspace, expand Site Operations, and click Servers and Site System Roles.
On the Home tab, in the Create group, click Create Site System Server.
On the General page, specify the general settings for the site system, and then click Next.
On the System Role Selection page, select the Distribution Point role, and then click Next.
Complete the wizard.

Note that you cannot enable PXE or Multicast support on your Windows 7 Distribution Point.

To troubleshoot your distribution point creation on the Windows 7 box, on your ConfigMgr site server, what does the distrmgr.log file tell you about the problem, if it's complaining about being unable to connect, then you could have firewall issues and/or wmi problems related to the fact that you have a firewall in place and/or IIS is not installed on the Windows 7 computer or doesn't have the following IIS features installed:

* IIS 6 WMI compatibility Feature
* IIS 6 Management compatibility feature

Make sure to verify firewall settings, and then verify that you installed IIS on the Windows 7 computer (note that installing the distribution point role doesn't automatically install IIS on your Windows 7 computer).

For more information about this requirement, see the Prerequisites for Site System Roles section in the Supported Configurations for Configuration Manager topic.
When you install a distribution point, Configuration Manager can install and configure IIS if it is not installed. If IIS is already installed, Configuration Manager will configure it to support required operations. Configuration Manager will not change settings that have been configured as part of an IIS template.

Next verify that you added the site server computer account to the local administrators group on the windows 7 box.

to see how your distribution point installation is progressing, you can monitor it in the ConfigMgr console, check the Distribution Point Configuration Status in Monitoring. Click on the machine name, then select the Details tab underneath, what does it say for your Windows 7 machine, you can even click on More Details in the ribbon to see if it provides more details about your issue.

once it's done installing the Distribution Point role you'll see it reports it successfully and creates the needed folder structure on your windows 7 box

if you forgot to install IIS then install it on your Windows 7 box (you don't need to reinstall the distribution point role)

once again, monitor the status of your dp again, it should refresh to all Green (ok) and finally, it's all done and working and content is being copied to your new distribution point.

How can I migrate registry keys from one location on the source to another on the destination

2012-02-17T16:02:00Z

if you want to migrate registry keys from one location to another (provided that they are detected) then use the following code in a custom XML file

<?xml version="1.0" encoding="UTF-8"?>
<migration urlid="http://www.microsoft.com/migration/1.0/migxmlext/WNB_move_reg_keys">
<!-- WNB_move_reg_keys.xml is basically a customized version of MigUser.xml -->
<_locDefinition>
  <_locDefault _loc="locNone"></_locDefault>
  <_locTag _loc="locData">displayName</_locTag>
</_locDefinition>
 
<!-- This component migrates Old Reg Keys and moves them to NEW locations provided that the key exists -->
<component context="User" type="Application">
  <displayName _locID="regkeymove_user">Move old reg keys to new location</displayName>
  <role role="Settings">
   <detects>
        <detect>
        <condition>MigXmlHelper.DoesObjectExist("Registry","HKLM\SOFTWARE\CUSTOM [CUSTOMval#1]")</condition>
        </detect>
   </detects>
   <rules>
        <include>
        <objectSet>
        <pattern type="Registry">HKLM\SOFTWARE\CUSTOM [CUSTOMval#1]</pattern>
        <pattern type="Registry">HKLM\SOFTWARE\CUSTOM [CUSTOMval#2]</pattern>
        </objectSet>
        </include>
        <locationModify script="MigXmlHelper.ExactMove('HKLM\SOFTWARE\CUSTOM [PrevCUSTOMval#1]')">
        <objectSet>
        <pattern type="Registry">HKLM\SOFTWARE\CUSTOM [CUSTOMval#1]</pattern>
        </objectSet>
        </locationModify>
        <locationModify script="MigXmlHelper.ExactMove('HKLM\SOFTWARE\CUSTOM [PrevCUSTOMval#2]')">
        <objectSet>
        <pattern type="Registry">HKLM\SOFTWARE\CUSTOM [CUSTOMval#2]</pattern>
        </objectSet>
        </locationModify>
   </rules>
  </role>
</component>
</migration>

this code checks if the following registry key exists HKLM\SOFTWARE\CUSTOM\CUSTOMval#1 and if it does, it migrates the following two registry keys from the SOURCE pc

HKLM\SOFTWARE\CUSTOM\CUSTOMval#1
HKLM\SOFTWARE\CUSTOM\CUSTOMval#2

to the following locations on the DESTINATION pc

HKLM\SOFTWARE\CUSTOM\PrevCUSTOMval#1
HKLM\SOFTWARE\CUSTOM\PrevCUSTOMval#2

Note: if you are using a 64 bit OS with a 32bit application (X86) that you'll probably want to change the path statements

for example, change

HKLM\SOFTWARE\CUSTOM [CUSTOMval#1]

HKLM\SOFTWARE\Wow6432Node\CUSTOM\ [CUSTOMval#1]

cheers
niall

don't want to migrate Pinned items with USMT 4 ? no problem

2012-02-17T15:34:00Z

another quick USMT post, if you want to avoid your Pinned items (for example Microsoft Office Outlook) from being migrated in a Win7 to Win7 migration, then include the following in a custom XML file as explained in this post, why do you want to do this, well if you don't you just might see Microsoft Office Outlook 2007 (2) as your pinned item name (for example) in the taskbar.

  <component type="Documents" context="user">
                <displayName _locID="miguser.User_Exclusions">User Exclusions</displayName>
                <role role="Data">
                        <rules>
                                <unconditionalExclude>
                                        <objectSet>
                                                <!-- exclude items pinned on the taskbar otherwise it'll cause the same items to show up as (2) desktop-->  
                               
                                                <pattern type="File">%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\* [*.lnk]</pattern>
                                               
                                               
                                        </objectSet>
                                </unconditionalExclude>
                        </rules>
                </role>
        </component>

and that's probably a good idea looking at my current Windows 7 taskbar the following items are pinned

Quote

Directory of C:\Users\niall\AppData\Roaming\Microsoft\Internet Explorer\Quic
k Launch\User Pinned\TaskBar

2012-02-17 15:45 <DIR> .
2012-02-17 15:45 <DIR> ..
2011-03-17 10:08 2 466 ConfigMgr Console.lnk
2011-03-17 09:58 1 457 Internet Explorer.lnk
2011-03-17 10:13 2 613 Microsoft Office Communicator 2007 R2.lnk
2010-12-20 18:18 2 693 Microsoft Office Outlook 2007.lnk
2011-11-16 08:20 1 160 Mozilla Firefox.lnk
2011-03-29 11:51 1 091 Notepad++.lnk
2009-07-14 05:54 1 304 Notepad.lnk
2009-07-14 05:54 1 242 Paint.lnk
2011-03-17 16:40 1 053 SCCM Client Center.lnk
2009-07-14 05:49 1 228 Windows Explorer.lnk

The original post is here on windows-noob.com

cheers

niall

How can I exclude Start Menu items from being captured and restored using a custom file in USMT 4

2012-02-16T14:08:00Z

when doing a Refresh from Windows 7 to Windows 7 you may have programs installed on the source computer which are not installed on the destination even if it's the same computer, and as a result you don't want to migrate those unusable shortcuts in the start menu,
here's how you can exclude them and in addition exclude some additional items like files on the desktop (msi/exe) or desktop shortcuts.

create a custom XML file which you will use in addition to the default USMT xml files that are provided with USMT.
copy the below content into this blank XML file
save the file as WNB.XML

<?xml version="1.0" encoding="UTF-8"?>
<migration urlid="http://www.microsoft.com/migration/1.0/migxmlext/WNB">
    <!--WNB.xml is basically a customized version of MigUser.xml -->

        <_locDefinition>
        <_locDefault _loc="locNone"></_locDefault>
        <_locTag _loc="locData">displayName</_locTag>
        </_locDefinition>
	<!-- This component EXCLUDES the following User specific stuff-->
	<component type="Documents" context="user">
		<displayName _locID="miguser.User_Exclusions">User Exclusions</displayName>
		<role role="Data">
			<rules>
				<unconditionalExclude>
					<objectSet>
						<!-- exclude items pinned on the taskbar otherwise it'll cause the same items to show up as (2) desktop-->	
						<pattern type="File">%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\* [*.lnk]</pattern>
						
												<!-- exclude blank links on the desktop-->	
						<pattern type="File">%CSIDL_DESKTOP%\* [*.msi]</pattern>
						<pattern type="File">%CSIDL_DESKTOP%\* [*.exe]</pattern>
						<pattern type="File">%CSIDL_DESKTOP%\* [*.lnk]</pattern>
						<pattern type="File">%CSIDL_DESKTOP%\* [*.lnk2]</pattern>

						<pattern type="File">%CSIDL_DESKTOPDIRECTORY%\* [*.msi]</pattern>
						<pattern type="File">%CSIDL_DESKTOPDIRECTORY%\* [*.exe]</pattern>
						<pattern type="File">%CSIDL_DESKTOPDIRECTORY%\* [*.lnk]</pattern>
						<pattern type="File">%CSIDL_DESKTOPDIRECTORY%\* [*.lnk2]</pattern>
						
						<pattern type="File">%CSIDL_COMMON_DESKTOPDIRECTORY%\* [*.msi]</pattern>
						<pattern type="File">%CSIDL_COMMON_DESKTOPDIRECTORY%\* [*.exe]</pattern>
						<pattern type="File">%CSIDL_COMMON_DESKTOPDIRECTORY%\* [*.lnk]</pattern>
						<pattern type="File">%CSIDL_COMMON_DESKTOPDIRECTORY%\* [*.lnk2]</pattern>
					
						<pattern type="File">%CSIDL_DEFAULT_DESKTOP%\* [*.msi]</pattern>
						<pattern type="File">%CSIDL_DEFAULT_DESKTOP%\* [*.exe]</pattern>
						<pattern type="File">%CSIDL_DEFAULT_DESKTOP%\* [*.lnk]</pattern>
						<pattern type="File">%CSIDL_DEFAULT_DESKTOP%\* [*.lnk2]</pattern>
						
							<pattern type="File">%CSIDL_COMMON_PROGRAMS%\* </pattern>
							<pattern type="File">%CSIDL_COMMON_STARTMENU%\* </pattern>
							<pattern type="File">%CSIDL_COMMON_STARTUP%\* </pattern>
							<pattern type="File">%CSIDL_DEFAULT_PROGRAMS%\* </pattern>
							<pattern type="File">%CSIDL_DEFAULT_STARTMENU%\* </pattern>
							<pattern type="File">%CSIDL_DEFAULT_STARTUP%\* </pattern>
							<pattern type="File">%CSIDL_PROGRAMS%\* </pattern>
							<pattern type="File">%CSIDL_STARTMENU%\* </pattern>
							<pattern type="File">%CSIDL_STARTUP%\* </pattern>
				

					</objectSet>
				</unconditionalExclude>
			</rules>
		</role>
	</component>
</migration>

wnb.xml (2.31K)
Number of downloads: 0

to use the file above, simply specify it in your Capture User State and Restore user State steps or manually specify it using i:\wnb.xml for example as below:-

C:\USMT\USMT\x64\scanstate.exe C:\USMTStores\OLD_COMPUTERNAME /c /o /nocompress /uel:30 /i:C:\USMT\USMT\x64\WNB.xml /i:C:\USMT\USMT\x64\MigApp.xml /i:C:\USMT\USMT\x64\MigUser.xml /config:C:\USMT\USMT\x64\Windows7_Config.xml /v:13 /l:C:\Windows\temp\scanstate.log /progress:C:\Windows\temp\scanstate_progress.log

the original post is here on windows-noob.com

Configuration Manager 2012 Survival Guide

2012-02-04T20:32:00Z

Microsoft have created a WIKI with some great content for Configuration Manager 2012, featuring videos, blogs, links, step-by-step Guides and more, check it out, and contribute if you can :-)

System Center 2012 Configuration Manager Survival Guide

How can I verify the CacheExpire timeout value on my PXE Service Point

2012-02-03T09:06:00Z

if you are getting the abortpxe.com error message you might want to adjust the CacheExpire value in the registry as detailed in the following post. A quick glance in the registry will reveal the value but you can also check what value is being used by examining the SMSPXE.log file and search for CacheExpire in the Log. Note that if you have several PXE Service Points (Configuration Manager hierarchy) that you'll need to make the change on each PSP that you want the CacheExpire value set to. Below is a sample of the CacheExpire value via a SMSPXE.log file:-

Loaded PXE settings from reg key HKLM\Software\Microsoft\SMS\PXE:
PXE Settings:
    IsActive: Yes
    SupportUnknownMachines: Yes
    MACIgnoreListFile: <empty>
    ResponseDelay: 0
    CacheExpire: 300
    HTTP Port: 8530
    HTTPS Port: 443
    IISSSLState: 0x0
    BindPolicy: Exclude <empty>
    TRK: <non empty>
    SiteSignCert: <empty>
    Root CA Certs: <empty>
    PXE GUID: 653697fc-53e6-4c32-9552-bfd5a1835623
    PXEPassword: <non empty>

The CacheExpire value above is set to 300 seconds, or five minutes. If your value is listed as 0 or 3600 then it's at the default setting of one hour, make your change in the registry and restart the Windows Deployment Service to see the change take effect. During testing you can set the value of the CacheExpire key to 60 (60 seconds = 1 minute). This will minimize PXE booting issues being caused by the SMS PXE cache. The default of the CacheExpire key is either 0 or 3600, both which are 3600 seconds (1 hour). After testing is complete, the value of this registry setting will need to be determined based on environmental conditions.

Note that each time WDS and the PXE Service Point is reinstalled the value of this key is reset back to 0.

For more info see: ConfigMgr 2007: Troubleshooting PXE Service Point Issues and WDS service not starting

using SCCM 2012 RC in a LAB - Part 14. Performing a side-by-side Migration from Configuration Manager 2007

2012-01-27T19:39:00Z

Some key points about migration.

Before you migrate any data from Configuration Manager 2007, you must first install and configure the System Center 2012 Configuration Manager hierarchy. You should not try to recreate or mirror your hierarchy from the source to the destination. Plan to only migrate what you need in the new hierarchy and focus on the new features and design of Configuration Manager 2012.

You cannot upgrade from SMS 2003 to Configuration Manager 2012, the only supported method is to migrate from SMS 2003 to Configuration Manager 2007 (in-place or side-by-side) and then perform a side-by-side migration to Configuration Manager 2012. Or, you could call it a day on SMS 2003 and start fresh with Configuration Manager 2012.

You cannot do an in-place upgrade from Configuration Manager 2007 to Configuration Manager 2012. If you want to migrate your data and objects from Configuration Manager 2007 to Configuration Manager 2012 then you have to perform a side-by-side migration.

Your source hierarchy (Configuration Manager 2007) must be at Service Pack 2 level.

You must specify the top level site of your source heirarchy (Configuration Manager 2007).

When System Center 2012 Configuration Manager gathers data, the following network protocols and ports are used: NetBIOS/SMB – 445 (TCP), RPC (WMI) - 135 (TCP), SQL Server - 1433 (TCP). As a result, ensure that they are not blocked between your source and destination servers.

To perform the migration, the account used in Configuration Manager 2012 console must be a member of the Full Administrator security role. This security role grants permissions to manage all migration operations, which includes the creation of migration jobs, cleaning up, monitoring, and the action to share and upgrade distribution points.

If you have mixed collections containing users and computers in Configuration Manager 2007, separate them into separate collections prior to the migration.

Site codes must be unique. You cannot re-use site codes from a source hierarchy (Configuration Manager 2007) to the destination hierarchy (Configuration Manager 2012).

When you migrate content, it is the compressed source files that migrate to System Center 2012 Configuration Manager.

We can migrate the following: Collections, Advertisements, Boundaries, Software distribution packages, Virtual application packages,Software Updates, Operating System Deployment, Desired Configuration Management, Asset Intelligence, Software metering rules.

Ok now that we are aware of the above, and after reviewing the pages on Technet for best practise advice, let's do a simple migration in our LAB. This LAB has a Configuration Manager 2007 server configured with a separate boundary from our Configuration Manager 2012 site boundaries. Both sites are within the same AD Forest. Both sites are standalone primaries. For this LAB we will migrate some Software Update items. Before doing so let's take a very quick look at what the software updates collection structure looks like in our Configuration Manager 2007 site.

Step 1. Specify Source Hierarchy
Perform the following on your Configuration Manager 2012 server as SMSadmin.

In the Administration workspace, expand Overview and select Migration, as we havn't migrated anything yet it's going to look pretty bland.

We need to specify the source hierarchy in order to establish a connection between the source (CM07) and destination (CM12) servers, so click on Specify Source Hierarchy in the ribbon.

when the wizard appears we need to specify the Top-Level Configuration Manager 2007 site server. So fill in those details.

Next we need to specify the Source site account to use to access the SMS Provider for that site server. The account needs read permissions on all source site objects. In our LAB we will specify the CM07Admin account which was the same account used to install that site server. So click on the Set drop down menu and select New Account.

Input your account credentials and click on Verify

Click on Test connection

make sure you see a successful connection before proceeding.

We will use the same account as the source site SMS provider account, so click on OK to exit this wizard.

after clicking ok you'll see a window informing you that it is gathering data from the source site

a few minutes later and it's done, close that window.

at this point we can now see that our migration summary window has populated with some information.

Note: You can start and stop the data gathering process by using the Gather Data Now, and Stop Gathering Data actions in the Configuration Manager console.

Step 2. Create a migration job
Perform the following on your Configuration Manager 2012 server as SMSadmin.

In the ribbon click on Create Migration Job

When the Migration Job wizard appears give it a name that is descriptive of what we are planning on migrating. Notice that in the drop down menu for Job Type we have three choices

Collection Migration
Object Migration
Objects modified after migration

In this case we are going to migrate collections, so we will name this migration job as follows:- Migrate Software Update Management Collections

Click next and a list of collections that can be migrated to Configuration Manager 2012 are displayed. As we are only interested in migrating our Software Update collections, let's select them. If you have advertisements associated with these collections (Deployment Management Tasks) then they will be migrated also if you select Migrate objects that are associated with the specified collections.

next we get to select objects that we want to migrate. Look through what is highlighted and decide if you really want to migrate it or not, this is a LAB so we'll let everything stay selected.

for Content ownership, specify which site in your Configuration Manager 2012 hierarchy will be the designated owner of the content, in our LAB we have standalone primaries so just click next.

next you can specify the Security Scope to be applied to the migrated objects, select the Default option. (I will return to Security Scopes in a separate Part).

if any collections need to be limited to All Systems or All Users then they'll appear here, we are ok so lets proceed.

On the Site Code Replacement screen you may see collections that are based on Queries that are limited to Site codes, we don't have any in this LAB so nothing appears, but if you have any queries like this in your LAB then you'll see those collections listed here. What it's telling you is that you'll have to edit the queries to point to the new site code.

and now you get to review the information, you can save it to a file (recommended) which is a plain text file that lists things that you should be aware of. Save the file, read it. Action it.

Next you can decide to run the migration job now (default) or schedule it until later. We want to migrate now so let's do that. Note that we don't want any new deployments being enabled after an advertisement is migrated so verify that setting is not selected (by default it is not selected). This will mean that you have to manually enable the deployments in Configuration Manager 2012, but that's ok isn't it.

click next at the summary and let the wizard do its work...then review the confirmation screen

Step 3. Monitor your migration job and resolve issues found.
Perform the following on your Configuration Manager 2012 server as SMSadmin.

In the console click on Migration Jobs and you'll see the status of our newly created migration job, in the screenshot below it is still running.

After a while it should complete, note that the status in our LAB says Failed. Before we find out why, let's review the information that the job shows us in the summary, in particular let's review the Object Migration Progress. We can see that it has migrated 2 objects, 7 failed and 3 were skipped.

Click on the Objects in Job tab to get specific information about the status of migration.

The objects that are skipped are empty collections (empty collections are NOT migrated). The failed objects are more interesting and you can select each object that has failed and read its corresponding message (by scrolling to the right) to find out what you need to do to fix it.

for example, the following message appears on one of the objects:-

Quote

The destination site has not yet synchronized the software update with UniqueID 5f8a1117-.....required for migration of the software update package. Ensure the software update point has been configured and the software updates are synchronized at the destination site.

Great, now we know what's wrong and how to fix it.

The message in this example is telling us that the products synched are not matching on the destination (it doesn't understand how to deal with them) so let's verify how our Products are configured on both sites, CM07 on the left, CM12 on the right, see the difference ?

They should both be identical prior to running the Migration Job, this is an important lesson for you :-)

So correct the problem, do a Software update sync on CM12 and run your migration job again. Repeat this process for each failed message until all messages have been actioned upon. Note that you will most likely have to go and Gather Data again particularly if the logs/messages tell you to do so. But once you've resolved the problems your migration should complete as per the screenshot below.

and here's what did get migrated, I may go into further details about migrations in a later post, notice the migrated Advertisments become Deployments.

another view in Software Library, Software Updates

don't forget to enable any Deployments that you want enabled

Finally, you can review the Migration Summary screen to get an overview of your total Migration Progress (you'll need to create more migration jobs to get the other objects if you want them

Troubleshooting note

You can review the migctrl.log and smsprov.log log files for more information about problems with your migration see screenshot below. They will give you more information about what is going on behind the scenes.

The original post is here on windows-noob.com.

using SCCM 2012 RC in a LAB - Part 13. using Role Based Administration to define permissions in the ConfigMgr Console

2012-01-27T11:06:00Z

In Part 1 of this series we got our AD and SCCM servers ready, and then we installed System Center 2012 Configuration Manager as a standalone Primary site. In Part 2 we configured the SCCM server further by adding some Windows Server roles necessary for the following Configuration Manager 2012 functionality, Software Update Point (SUP) and Operating System Deployment. In Part 3 we configured the server further by Enabling Discovery methods and creating Boundary's and Boundary Groups. In Part 4 we configured Client Settings, Added roles and Distributed the Configmgr Client to our Computers within the LAB, then in Part 5 we enabled the Endpoint Protection Role and configured Endpoint Protection settings and targeted a collection called All Windows 7 Computers with these settings and policies.

In Part 6 we configured our SUP further to Deploy software updates to our All Windows 7 Computers and Build Windows 7 X64 collections. In Part 7 we used the Build and Capture process to create our Base Windows 7 X64 wim image. In Part 8 we created a USMT 4 package to migrate the users data using hardlinking and then we imported the captured image into ConfigMgr and created a Deploy Windows 7 X64 task sequence. We created a Deploy Windows 7 X64 Collection and set some User Device Affinity collection variables.

In Part 9 we created an Application, and created a deployment type for that application to only install if the Primary User was True for that device (User Device Affinity), we then copied our Task Sequence (duplicated it), deployed the new Task Sequence, added a computer to the new collection and then PXE booted the computer to the Deployment Menu. In Part 10 we monitored the Deployment process in a lot of detail to how UDA sent state messages and we verified that our application installed on the users Primary Device, in addition we modified our collection variables, and added a prestart command to our boot image to prompt for the SMSTSUdaUsers. In Part 11 we setup the Reporting Services Point Role and verified that reporting was working.

In Part 12 we demonstrated a new feature in ConfigMgr which allows us to Patch operating system WIM images using Offline Servicing. This means that you can apply Windows Updates by using Component-Based Servicing (CBS) to update the your previously captured WIM images. Now we will look at how Role Based Administration is used within ConfigMgr and we will create a new custom role to allow a user (or users within a Security Group) to view Software Update Reports. This is useful because you will probably want one team to take care of configuring and deploying software updates, and to grant another (Management etc) the capability of reviewing Compliance Reports.

Note: From this point on, all parts in this series will be created using Configuration Manager 2012 Release Candidate 2 unless otherwise specified.

For more information about Role Based Administration and for best practise advice please review the following:-

Technet:-
Security: Role-Based Administration Section of Whats new in Configuration Manager 2012 here
Planning for Security in Configuration Manager 2012 - http://technet.micro...y/gg712284.aspx
Introducing Role-Based Administration in System Center 2012 Configuration Manager - http://blogs.technet...on-manager.aspx

Step 1. Understanding Role Based Administration

In Configuration Manager 2007, administrative access to site resources is controlled by using class and instance security settings that are verified by the SMS Provider computer to allow access to site information and configuration settings. System Center 2012 Configuration Manager introduces role-based administration to centrally define and manage hierarchy-wide security access settings for all sites and site settings.

Instead of using individual class rights, role-based administration uses security roles to group typical administrative tasks that are assigned to multiple administrative users. Security scopes replace individual instance rights per object to group the permissions that are applied to site objects. The combination of security roles, security scopes, and collections allow you to segregate the administrative assignments that meet your organization requirements and this combination defines what an administrative user can view and manage in the Configuration Manager hierarchy.
Role-based administration provides the following benefits:

Sites are no longer administrative boundaries. They were with Configuration Manager 2007.
You create administrative users for the hierarchy and assign security to them one time only.
You create content for the hierarchy and assign security to that content one time only.
All security assignments are replicated and available throughout the hierarchy.
There are built-in security roles to assign the typical administration tasks and you can create your own custom security roles.
Administrative users see only the objects that they have permissions to manage.
You can audit administrative security actions

What roles are included ?

The following 14 built in security roles are included:-

Operations Administrator
Full Administrator
Infrastructure Administrator
Security Administrator
Software Update Manager
Read-Only Analyst
Remote Tools Operator
Operating System Deployment Manager
Application Deployment Manager
Application Author
Application Administrator
Asset Manager
Endpoint Protection Manager
Compliance Settings Manager

Step 2. Implementing a custom security role.
Perform the following on your Configuration Manager 2012 server as SMSadmin.

In the ConfigMgr console, click on Administration and expand Security, click on Security Roles. The 14 built-in roles appear.

We want to create a custom security role to allow users assigned to that role to read Software Update Reports. As there is no option to create a blank new role, we must use the Copy function to create our new security role. Select the built-in Software Updates Manager role, right click and choose Copy.

When the Copy Security Role wizard appears, give the new role a name based on the function, you can name the new role as follows:- SUM Reports Reader it's also a good idea to fill in a Description of the role as per the screenshot below, notice all the predefined permissions assigned to the Software Updates Manager role appear selected in the Permissions pane. We will edit these to only leave those permissions that are required to run reports.

using the Customize the permissions for this copy of the security role, expand any permission not required and change it from YES to NO (you can double click on each one to change). For example, expand the Alerts permissions and set them all to NO as none of these permissions is required to read reports.

Configure the Permissions so the only the following are set to Yes

Site: Read

Software Updates: Read, Run Report

Click OK when done, the custom SUM Reports Reader role now appears in your console.

Step 3. Create a Global Security Group in Active Directory
Perform the following on your Active Directory Domain Controller server as Domain Administrator.

Now that we have created our custom security role, we want to assign users to that role. In Active Directory Users and Computers create a new Global Security Group called Software Updates Management Report Readers as per the screenshot below.

To create a new global security group, right click on Users, select New, Group.

Add some users to that group by selecting those users and right-clicking, choose Add to a Group

when the Select Groups wizard appears, type in the name of our security group and click on Check Names, click ok when done.

you've now added some users to the Active Directory security group called Software Updates Management Report Readers.

Step 4. Assign the Active Directory Security Group to our custom role
Perform the following on your Configuration Manager 2012 server as SMSadmin.

In the Administration pane, expand security and select Administrative Users.

In the ribbon click on Add User or Group

when the Add User or Group wizard appears select browse and search for our previously created Active Directory Security Group, type in Software Updates Management Report Readers and click ok

next we need to assign this group with our custom role, so select Add to add security roles, scroll through the list of roles and select our custom role: SUM Reports Reader as per the screenshot below

Click OK when done (leave the Assigned security scopes and collections as they are)

Our active directory security group is now assigned the custom SUM Reports Reader security role.

Step 5. Verify the custom role has the permissions we need
Perform the following on your Configuration Manager 2012 server as a member of the Software Updates Management Report Readers active directory security group.

We will now test our new custom role by starting the Configuration Manager console as a user which is a member of the previously created active directory security group. To do this right click on the Configuration Manager console icon in the system tray and hold down the shift key, then right click again (while holding down shift) on the new configuration manager console icon so that we can get a context based menu option called Run as Different User.

when the security credentials window appears, type in the credentials of a domain user that you have previously added to the Software Updates Management Report Readers active directory security group, click ok when done.

After a while, the Configuration Manager console will appear as it would if started by that user and you can immediatly see that it looks different, only the bits that are relevant to this user running Software Update reports are displayed in the console.

When you add (or remove) permissions from the role, this view will change however you should close and re-open the console to see the new view with the credentials of your desired user. We have already defined our permissions so lets select Monitoring and expand Reporting and then select Reports. Notice how only 48 software update related reports appear (in comparison to the 445 or so reports that a member of the Full Administrator security role would be able to view).

and below is what a Full Administrator would see in the same Reports pane

The difference in the number and type of reports available and what you can do/see in the Configuration Manager console is governed by Role Based Administration, cool huh ?

The original post is here on windows-noob.com

Two New Endpoint Protection Reports added to Configuration Manager 2012 RC2

2012-01-25T12:13:00Z

Up until recently, Endpoint Protection came with 4 built-in reports in Configuration Manager 2012.

AntiMalware Activity Report
Computer Malware Details
Top Users By Threats
User Threat List

As of RC2 there are now six built-in reports

AntiMalware Activity Report
Computer Malware Details
Top Users By Threats
User Threat List
Infected Computers
Dashboard

so what are the new reports about ? The fist new Endpoint Protection report shows a nice list of Infected Computers in a timeframe that you can select, you can verify what type of remediation was done via drop down menu and even search by Threat Name (see below).

Next we have the Dashboard Report, this report shows lots of nice graphs to give you a graphical view of overall Endpoint Protection status in the collection you selected, malware remediation status, Operation Status of Endpoint Protection clients, Definiton status on Computers (see below)

In other words, this report shows summaries of what you can see in the In-console monitoring Endpoint Protection Dashboard in the Monitoring node of the ConfigMgr Console.

all in all, very cool stuff, if you havn't yet started experimenting with Endpoint Protection in Configuration Manager 2012 then get started, it's a Blast !!

Niall C. Brady at myITforum.com

moving my blog to niallbrady.com

Customising Windows 7 deployments - Part 6. Adding multiple keyboard layouts and multiple languages

using SCCM 2012 RC in a LAB - Part 16. Integrating MDT 2012 RC1 with Configuration Manager 2012

Using SCCM 2012 RC in a LAB - Part 15. Deploying Windows 8 Consumer Preview using Configuration Manager 2012 RC2

Invalid character in unattend.xml file causing Windows 7 Service Pack 1 Offline Language Pack installation failure

How can I capture an image using capture media in ConfigMgr 2012

How can I setup a Distribution Point in ConfigMgr 2012 on a Windows 7 computer?

Recommended Reading: Technet:- http://technet.microsoft.com/en-us/library/hh272770.aspx#BKMK_Distribution_Point For information about how to configure the distribution point for content deployment, see Configuring Content Management in Configuration Manager.

How can I migrate registry keys from one location on the source to another on the destination

don't want to migrate Pinned items with USMT 4 ? no problem

How can I exclude Start Menu items from being captured and restored using a custom file in USMT 4

Configuration Manager 2012 Survival Guide

How can I verify the CacheExpire timeout value on my PXE Service Point

using SCCM 2012 RC in a LAB - Part 14. Performing a side-by-side Migration from Configuration Manager 2007

using SCCM 2012 RC in a LAB - Part 13. using Role Based Administration to define permissions in the ConfigMgr Console

Two New Endpoint Protection Reports added to Configuration Manager 2012 RC2

Recommended Reading:

Technet:- http://technet.microsoft.com/en-us/library/hh272770.aspx#BKMK_Distribution_Point

For information about how to configure the distribution point for content deployment, see Configuring Content Management in Configuration Manager.