Roger Zander at myITforum.com

Monitoring CM12 Prerequisites and IIS configurations

rzander — Mon, 13 May 2013 11:35:00 GMT

Is IIS on your CM12 Site Systems properly configured ? An easy way to monitor (and automatically fix) your settings is using the compliance settings management from Configuration Manager 2012…

Based on Prerequisites for Site System Roles , I’ve created a DCM Baseline example that monitors and fixes IIS configurations and missing Server features that are used on ConfigMgr2012 Site System Roles …

Configuration Matrix:

Note: This is just an example… do not enable auto remediation if you are not 100% sure what the CI’s are doing… ! Use at your own risk.

Download the DCM Baseline here: IIS Configuration for CM12.zip

Collection Commander for Configuration Manager 2012

rzander — Mon, 29 Apr 2013 14:15:00 GMT

A first beta of Collection Commander for Configuration Manager 2012 is now published on http://cmcollctr.codeplex.com. Collection Commander for CM12 is an extended version of the recently released Patch Monitoring Tool for CM12 .

It does use the SCCM Client Center Automation Library (which requires WinRM) as core, but can also run custom powershell commands against multiple systems. If you are missing some commands, please report your wishes on the project page.

Installing the CM12 Console Extension (right click option):
- run "CMCollCtr.exe /Install" to install the right click option

Usage:
- right click a Collection in CM12 and select "Collection Commander...", or copy and paste computernames on the tool.
- the tool will automatically ping all systems and check for pending reboot etc.
- select one or multiple rows and right click to get the option to "Run powershell code..."
- select a Powershell command from the template list or write your own command
- ... the Powershell result will be retunred to the "StatusMessage" column.

Have fun

SCCM Client Center 2.0.4.2 released

rzander — Thu, 18 Apr 2013 18:50:00 GMT

Thanks to Mark Whitte for reporting and fixing!!! some Issues on SCCM Client Center (the one for SCCM 2007).

Version 2.0.4.2 includes the following changes:

Bug: Slp doesn't clear after connecting to a computer/new computer
Bug: Getting services can be called multiple times.
Bug: Getting Execution history over Remote registry sometimes fails (seen with 127.0.0.1 connections)->Add more meaningful message to error showing that the RemoteRegistry Service needs to be running
Bug: The Show advertisement button should clear the lower detail pane
Bug: The Show execution history button should clear tool tip at start
Bug: When connection fails the connected button should not read connected (happens if a successful connection was previously established)
Bug: Show schedules is slow to start. Looks like the first time we check if 64bit it takes a long time to determine, subsequent checks are cached.
Feature Request: Can the about box show in the taskbar?
Feature Request: Add more columns to Process View
Feature Request: Make Process View filterable
Feature Request: Add branch distribution support

The MSI on http://sourceforge.net/projects/smsclictr/ is updated and includes the latest Version.

For existing Installations, an update can be downloaded from: http://smsclictr.sourceforge.net/update/

And a final Note: The CM12 Version is growing at http://sccmclictr.codeplex.com/... please place your feature requests (or vote on existing requests) and Issues on the project page.

Multiple entries for TopConsoleUser

rzander — Thu, 21 Mar 2013 10:03:00 GMT

I have seen an Environment where the Table SYSTEM_CONSOLE_USAGE_DATA had multiple entries per device… with the result that the TopConsoleUser was an old,orphaned entry on some reports.

The following Query will return all affected Machines:

SELECT COUNT(*) as [Count], System_DISC.Netbios_Name0, SYSTEM_CONSOLE_USAGE_DATA.MachineID 
FROM SYSTEM_CONSOLE_USAGE_DATA INNER JOIN 
     System_DISC ON SYSTEM_CONSOLE_USAGE_DATA.MachineID = System_DISC.ItemKey 
GROUP BY System_DISC.Netbios_Name0, SYSTEM_CONSOLE_USAGE_DATA.MachineID 
HAVING COUNT(*) > 1

A full Hardware Inventory cycle removed the duplicates. You can use Collection Commander to enforce a full HW Inventory on the affected clients…

Patch Monitoring Tool for CM12

rzander — Wed, 06 Feb 2013 14:50:00 GMT

I made this adhoc Tool to get a brief overview of the Patch-Status from a list of machines... You can right click selected rows to trigger some patch related actions:

Requirements:

- Tool must run as Admin and the Account must have Admin rights on the target devices
- WinRM must be enabled (run winrm /quickconfig)

Notes:

-          CMHealthMon.exe /install will install a CM12 Console Extension on Collections
-          You can Copy/Paste List of Computernames
-          SCCM2007 Agents are not supported !
-     WinRM allows out of the Box 5 concurrent connections, the Tool is using 4 concurrent connections. You may have to extend the MaxConcurrentUsers via GPO.

There is no support or warranty !

Download here

Configuration Manager 2012 SP1 Agent depends on Network List Service

rzander — Mon, 14 Jan 2013 15:35:00 GMT

If the "SMS Agent Host" service does not start after migrating to Configuration Manager 2012 SP1 and you find the following error in ccmexec.log:

Initialzing power state manager.
Initialzing network state manager.
[NWCOST] UNRESTRICTED
Phase 0 initialization failed (0x80070422).
Service initialization failed (0x80070422).
Shutting down CCMEXEC...
Waiting up to 2 seconds for active tasks to complete...
Finished shutting down CCMEXEC.

... verify that the "Network List Service" (netprofm) is NOT disabled and running !

Command to install all pending SW Updates on a CM12 Client...

rzander — Tue, 20 Nov 2012 13:12:00 GMT

The following PowerShell command will install all approved updates (also those without a deadline) on a ConfigMgr2012 Client:

([wmiclass]'ROOT\ccm\ClientSDK:CCM_SoftwareUpdatesManager').InstallUpdates([System.Management.ManagementObject[]] (get-wmiobject -query "SELECT * FROM CCM_SoftwareUpdate" -namespace "ROOT\ccm\ClientSDK"))

To install only the updates with a deadline:

([wmiclass]'ROOT\ccm\ClientSDK:CCM_SoftwareUpdatesManager').InstallUpdates()

SCCM Client Center Integrationpack for Orchestrator 2012

rzander — Fri, 13 Jul 2012 11:33:00 GMT

The SCCM Client Center Integrationpack is now available for Orchestrator 2012.... http://sccmclictropalis.codeplex.com/

a special thanks to Christopher Keyaert for creating and testing the IP on Orchestrator 2012.

Powershell commands to manage ConfigMgr 2012 Agents

rzander — Fri, 29 Jun 2012 07:51:00 GMT

Did you know that Client Center for CM12 provides the Powershell code for all of the functions in the tool... ?!

Just make your changes in the the Tool and copy the powershell code from the text box:

Client Center for Configuration Manager 2012

rzander — Tue, 22 May 2012 10:20:00 GMT

A preview of Client Center for Configuration Manager is published on codeplex.

Start the Click-Once release from:
http://sccmclictr.codeplex.com/releases/clickonce/SCCMCliCtrWPF.application?localhost

Note: This is an alpha Version with a limited set of features.
New features and functions for CM12 will follow (step-by-step)...

Requirements:
- .NET Framework 4.0
- WinRM enabled (run 'WinRM quickconfig' in a command prompt)

If you have any wishes or ideas, please place your comment on the Project-Page.

DateTime Attributes in DDR Files

rzander — Thu, 26 Apr 2012 12:17:00 GMT

The SCCM Client Center Automation Library does now support creating DDR Files with DateTime Attributes.

The following example (C#) will generate a simple DDR with a DateTime Attribute (ADLastLogon):

smsclictr.automation.DDRFile oDDR = new smsclictr.automation.DDRFile("System", "CustomDiscovery", "C01");

oDDR.DDRAddString("Name", Environment.MachineName, 16, smsclictr.automation.DDRFile.DDRPropertyFlagsEnum.ADDPROP_NAME |

smsclictr.automation.DDRFile.DDRPropertyFlagsEnum.ADDPROP_KEY);

oDDR.DDRAddString("Netbios Name", Environment.MachineName, 16,

smsclictr.automation.DDRFile.DDRPropertyFlagsEnum.ADDPROP_NAME);

oDDR.DDRAddDateTime("ADLastLogon", DateTime.Parse("26.04.2012 13:45:00"),

smsclictr.automation.DDRFile.DDRPropertyFlagsEnum.ADDPROP_NONE);

oDDR.DDRWrite(@"C:\TEST.ddr");

as a result, you will get a DDR File in C:\Test.ddr that has the following structure:

BEGIN_PROPERTY

<76><Name><11><16><myComputer>

END_PROPERTY

BEGIN_PROPERTY

<68><Netbios Name><11><16><myComputer>

END_PROPERTY

BEGIN_PROPERTY

<0><ADLastLogon><12><4><04/26/12 13:45:00>

END_PROPERTY

AGENTINFO<CustomDiscovery><C01><4/26/2012 13:52:51>

SCCM2007 PostSP2 Agent Fixes

rzander — Thu, 12 Apr 2012 08:41:00 GMT

Have you installed all related SCCM2007 PostSP2 Hotfixes on the SCCM Agents... ? Are you sure that the fixes are really in place ?
It seems that the installation Order is important to have successfully updated Agents. As an example, KB2276865 will not install the related Files if the Patch will be installed in a wrong order (at least in my current environment)...

The following Table does show the installation order for the current PostSp2 Agent Hotfixes (or at least all I'm aware of):

Hotfix	HotfixLevel	Inst Order	Comment
KB977203	111	1	for Multicast enabled DP's (replaces Mcsisapip.dll)
KB978754	115	2	OSDCore.dll (4.0.6487.2115)
KB981639	134		Superseeded by KB2691428
KB2276865	152	3	Superseeded by KB2678547
KB2278119	154		Superseeded by KB977384
KB977384	157	4
KB2444668	161		Superseeded by KB2691428
KB2516517	177	5
KB2509007	188	6
KB2691428	198	7	Ai rollup Fix
KB2678547	202	8

You should check your SCCM Agents if the following Files are in place:

File	Version	Size	KB
1033\Pwr_res.dll	4.0.6487.2157	3072	977384
Assetadvisor.dll	4.0.6487.2198	312168	2691428
CcmCTM.dll	4.0.6487.2101	299352	977384
Ccmgencert.dll	4.0.6487.2111	130408	977384
Ccmutillib.dll	4.0.6487.2155	186728	977384
climsgs.dll	4.0.6487.2157	264040	977384
execmgr.dll	4.0.6487.2160	491880	2516517
InvDataStore.dll	4.00.6487.2120	65896	2691428
Lsinterface.dll	4.0.6487.2177	459624	2516517
Lsutilities.dll	4.0.6487.2155	317288	2516517
Osdcore.dll	4.0.6487.2115	1165160	978754
Pwragentendpoint.dll	4.0.6487.2157	352600	977384
Pwreventtask.dll	4.0.6487.2157	98136	977384
Pwrhinvprov.dll	4.0.6487.2157	98152	977384
smsswd.exe	4.0.6487.2108	144232	2678547
Srvwinmgr.dll	4.0.6487.2154	120168	977384
Tscore.dll	4.0.6487.2192	1172328	2678547
TSManager.exe	4.0.6487.2192	246632	2678547
TSMBootstrap.exe	4.0.6487.2192	354664	2678547
TSMessaging.dll	4.0.6487.2192	144232	2678547
Updatesdeployment.dll	4.0.6487.2158	535384	2509007
Updateshandler.dll	4.0.6487.2188	389992	2509007
Vappcollector.exe	4.0.6487.2198	255336	2691428

The following Tool will check the File Versions on the local Client to detect missing Hotfixes:

http://myitforum.com/cs2/blogs/rzander/HotfixCheck.zip

(Microsoft .NET Framework 4 and SQL Server Compact 3.5 required)

Let me know if there are any other Updates that are not on this list...

SCCM2012 ClientSDK Namespace

rzander — Mon, 07 Nov 2011 19:04:00 GMT

CM2012 Provides a ClientSDK WMI Namespace (root\ccm\clientsdk) to interact with the SCCM2012 Agent. The following Diagram shows all Classes and Methods of that Namespace (it’s from the Beta2 of CM2012)

Full_Image

offline installation Tool for App-V

rzander — Wed, 21 Sep 2011 19:08:00 GMT

Just released a new Tool to install App-V packages from USB, local Disks or UNC Path:

http://appvimport.codeplex.com/

Have fun…

SCCM In-place migration with encrypted disks

rzander — Fri, 16 Sep 2011 08:42:00 GMT

Note!: The following content was provided from my Colleagues Armin Denzler and Markus Stucki. Thanks these guys to share the knowledge of their work.

Warning, use at your own Risk!

The final WinPE boot image may contain a mechanism to format the partition(s) on the local drive before SCCM Task Sequence logic comes up. Thus, simply booting from this image could cause loss of data!

The following Solution may not be supported by Microsoft.

Problem

In-place migration of Systems with encrypted Disks is out-of-the box not possible with SCCM2007 Task-Sequences. This is because the Task-Sequence has to boot into WinPE to apply the new Operating System but WinPE will not be able to read the Task-Sequence Environment from the encrypted Disk.

Booting WinPE from DVD or USB is not a Problem, because WinPE will initially load the TS-Environment from the Boot-Media and does not touch the encrypted disk.

Now, the Question with an in-place migration scenario is: how to boot into WinPE from the encrypted Disk, but let WinPE assume that it was started from a standalone media…

Solution

The following chapters describe a solution to adopt this workflow by creating a highly customized WinPE boot image (WinPE 3.0, version 6.1.7600). This solution, which was found in teamwork by Armin Denzler and Markus Stucki, might not be supported by Microsoft :-).

The Solution requires two Task-Sequences with two different Boot-Images assigned to the target Computer.

Task-Sequence #1 is defined to run only on the installed OS (specify the platform requirements on the TS to run only on the specified platform like “All x86 Windows XP”). This TS can be used to backup local data to a Network-Share.

Task-Sequence #2 is defined to be “available to boot media and PXE” (Advertisement Option) and it must only run from WinPE (You can limit the platform requirements to an unused OS like “x64 Windows XP Professional SP1”).

You may also have to define some conditions in the TS to prevent running the TS on the wrong OS.

TS#2 needs the standard Boot-Image that also is used with DVD/PXE boot.

TS#1 needs a modified Boot-Image that format the encrypted Disk (Dangerous!) and copy the TS Environment from WinPE#2 to the local empty disk.

As a Result, WinPE#1 does look for SCCM like WinPE#2 from a Boot-Media or PXE and the assigned TS#2 will start.

Note:
In general, it would also be possible to use this solution for just prestaging the modified boot image on target computers but preferably, SCCM R3 feature "Prestaged Media Provisioning" should be used.
If necessary, 802.1x Network Authentication may also be included, see http://myitforum.com/cs2/blogs/lakey81/archive/2011/07/06/configuring-802-1x-network-authentication-for-winpe-3-0-and-configmgr-deployments.aspx.

Technical Details

The following difficulties are to be solved:

A) Per design, SCCM Task Sequence Engine checks where WinPE is booted from (PXE / Removable Media / Local Disk) and sets variable %CONFIGPATH% accordingly.

If WinPE was booted from a local disk, SCCM expects that the WinPE boot was initiated by a previously started TS and tries to read current status from local disk.

Details:

a. file ".\sms\bin\x64\TsBootShell.ini" refers to variable %CONFIGPATH%

b. %CONFIGPATH% specifies where the TS environment is located (à VARIABLES.DAT)

c. if WinPE is booted from

- CD/DVD:
SCCM sets %CONFIGPATH% to "<CD-drive-letter>:\"
SCCM automatically contacts the SCCM MP to check for assigned Task Sequences.

- PXE:
SCCM sets %CONFIGPATH% to "X:\sms\data\"
SCCM automatically contacts the SCCM MP to check for assigned Task Sequences.

- Local Disk,
SCCM sets %CONFIGPATH% to "<local-HD-drive-letter>:\_SMSTaskSequence"
This implies that a TS is already running and SCCM TS Engine tries to read status from local disk

This means that if SCCM TS Engine shall "forget" that there is a TS in progress (even if WinPE was booted from local disk), the path to configuration data must be manipulated in TsBootShell.ini not to point to a location on local disk:

- If the disk is NOT encrypted, SCCM TS Engine can access the files and finds that a Task Sequence is in progress (the TS which was started in full OS) and continues the TS (even if reboot to WinPE is the last step, TS resumes just to finish)

- If the disk IS encrypted, SCCM TS Engine cannot access files on local disk and fails

The solution is to

I) inject the TS environment information from an SCCM Bootable Media (complete content of folder .\SMS\DATA) into the boot image

II) modify ".\sms\bin\x64\TsBootShell.ini" in the boot image to point to a fixed path in RAMDRIVE X: rather than using the variable (/configpath:X:\sms\DATA instead of /configpath:%CONFIGPATH% )

B) When a boot image is added to SCCM (via console), it is modified and amongst other changes, the modified file ".\sms\bin\x64\TsBootShell.ini" is overwritten (SCCM defaults).

The solution is to

I) Mount the boot image and copy the required information (modified TsBootShell.ini and content of folder .\SMS\DATA from SCCM Boot Media) to a custom folder

II) Modify the WinPE startup process to copy the customized data from the custom folder to the according SCCM folders before the SCCM TS Engine is started:

- Per WinPE / SCCM default, TsBootShell.exe is called by winpeshl.exe as defined in winpeshl.ini.

- This process can be changed via modification of registry key HKLM\SYSTEM\Setup\CmdLine

Instead of directly calling winpeshl.exe, a batch file is called which performs the necessary copy actions and calls winpeshl.exe afterwards.

For more information, see http://technet.microsoft.com/en-us/library/dd744556(WS.10).aspx

C) When the SCCM TS Engine is started in WinPE (PE booted from local disk), it checks for a specific file in the root of the drive where boot.wim is located. File name is identical in each environment: "_SMSTSVolumeID.7159644d-f741-45d5-ab29-0ad8aa4771ca"
If the disk is encrypted, SCCM Task Sequence is unable to read this file and fails with error "Unable to read task sequence configuration disk".

The solution is to

I) Capture this file by starting a Task Sequence which just contains the instruction "Restart Computer" to "The boot image assigned to this task sequence" (with a long time out to reboot, this allows copying the file before the shutdown is initiated).

II) Place this file in the custom folder in the boot image

III) Format the local disk and copy the file to the root of the partition on local disk before the SCCM TS Engine is started

D) When a TS starts in WinPE, it checks the ID of the boot image which is associated to the task sequence.

As the customized boot image contains the environment (VARIABLES.DAT) which was obtained from a default SCCM Boot Media, it "inherits" the "BootpackageID" (which is the ID of the boot image that was selected in the "Task Sequence Media Wizard").

This leads to a discrepancy between the Image ID which is registered in SCCM and the Image ID stored in the image itself (it can be considered it as a mismatch between "internal" and "external" ID).

This means that the customized boot image cannot be assigned to an OS task sequence because it would result in a reboot loop:

SCCM checks if the currently running WinPE matches the assigned boot image ID. As the internal ID does not match, TS Engine loads the boot image with the according external ID again.

The solution is to use two different task sequences:

1) First Task Sequence is started in full OS to perform some actions like backing up data to the network followed by the step "Restart Computer" (to "The boot image assigned to this task sequence").

2) Second Task Sequence is a mandatory OS Task Sequence (associated with a "normal" boot image).

When WinPE is started from the modified boot image on local disk, SCCM will behave like being booted from a DVD/USB boot media and contact the MP and start execution of the assigned OS Task Sequence.

Step by Step

The following steps show how to create a customized x64 WinPE boot image (WinPE 3.0, version 6.1.7600) which allows booting WinPE from local disk but nevertheless start a task sequence from network:

1) Create a Task Sequence Media (Bootable Media à CD/DVD Set)

2) Extract ISO generated in step 1, make a copy of folder <extracted-iso-folder>\SMS\DATA

3) mount the boot image which will be associated with the task sequence

E.g.:
dism /mount-wim /wimfile:"C:\SCCM\BootMedia\boot-WinPE-from-HD.wim" /index:1 /mountdir:"C:\Temp\WimMountBootWim"

4) In the "root" of the mounted WIM (parameter "MountDir" in dism command),

a. create a folder named "CustomBoot"

b. copy complete DATA folder from step 2) to "CustomBoot"

c. if necessary, edit file TSMBOOTSTRAP.INI to set "Unattended=TRUE"

d. in folder "CustomBoot" create file "TsBootShell.ini" with the following content:

[Shell]
OrgName=
EnableDebugShell=true
Run=X:\sms\bin\x64\TsmBootstrap.exe /env:WinPE /configpath:X:\sms\DATA

e. if disk encryption is in place:

i. Create a task sequence which contains the step "Restart Computer" to "The boot image assigned to this task sequence". Set a long timer for reboot, e.g. 600 seconds.

ii. Advertise the TS to a test machine

iii. When the boot image is staged on the local disk and the reboot countdown begins, file "_SMSTSVolumeID.7159644d-f741-45d5-ab29-0ad8aa4771ca" should exist in the root of %SystemDrive%.

iv. copy the file to a temporary network location and add it to folder "CustomBoot" in the mounted boot image

5) Modify registry

a. load hive SYSTEM from "<mountdir>\Windows\System32\Config\SYSTEM"):

[HKEY_LOCAL_MACHINE\_WinPE-Reg-SYSTEM\Setup]
"CmdLine"="CustomStart.cmd"

b. unload hive

6) Create the file "<mountdir>\windows\system32\CustomStart.cmd" with the following content:

copy /y x:\CustomBoot\TsBootShell.ini x:\sms\bin\x64\*.*
xcopy /e /i /y x:\CustomBoot\DATA x:\sms\DATA
winpeshl.exe

If the disk is encrypted, a few more commands need to be added to CustomStart.cmd.
Additionally required actions are

- format the partition(s)

- copy file _SMSTSVolumeID... to the root of the drive where WinPE was bootet from (SCCM TS Engine expects this file to be located there), for example drive "C:"

copy /y x:\CustomBoot\TsBootShell.ini x:\sms\bin\x64\*.*
xcopy /e /i /y x:\CustomBoot\DATA x:\sms\DATA
format c: /q /v:tmpname /y
copy x:\CustomBoot\_SMSTSVolumeID.7159644d-f741-45d5-ab29-0ad8aa4771ca c:\
winpeshl.exe

7) unmount the WIM and use dism parameter "/commit", add boot image to SCCM and/or update Distribution Points

8) Associate the customized WIM image with a task sequence which is started in full OS, then create an advertisement for this TS.

9) Create a 2^nd task sequence for OS deployment and create a mandatory advertisement.

Download PDF