Sherry Kissinger at myITforum.com

Mof extension to get Physical Hard Drive Serial Number

skissinger — Wed, 27 Aug 2008 01:24:00 GMT

In either ConfigMgr or SMS, add this mof snippet to sms_def.mof in inboxes\clifiles.src\hinv on your primary sites. Note for the SMS2003 admins: no mofcomp'ing required on your clients; this is a server-side only edit.

[ SMS_Report     (TRUE),
SMS_Group_Name ("Physical Media"),
SMS_Class_ID   ("CUSTOM|PHYSICAL_MEDIA|1.0") ]

class Win32_PhysicalMedia : SMS_Class_Template
{
    [SMS_Report (TRUE)     ]        string     SerialNumber;
    [SMS_Report (TRUE), key]        string     Tag;
};

Sample Report; remember to add the prompt for ComputerName

select distinct sys.netbios_name0, dsk.Model0,
Phys.Tag0, Phys.SerialNumber0 from v_gs_physical_media0 as Phys
inner join v_r_system as sys on sys.resourceid=phys.resourceid
inner join v_gs_disk as dsk on Phys.resourceid=dsk.resourceid
where
sys.netbios_name0 = @ComputerName
and dsk.deviceid0=Phys.tag0
order by Phys.tag0

ResourceExplorerSample, ReportSample

Hardware Inventory Action missing on ConfigMgr Client

skissinger — Tue, 26 Aug 2008 02:11:00 GMT

Other than the obvious (you didn't enable Hardware Inventory in the console, Client Agents), if on your client the Hardware Inventory action is missing, the issue may be a misconfigured hardware inventory MOF file, configuration.mof, on your primary site.

I've had this happen twice in the lab, the first time I didn't write down what I did to fix it, but this second time--which took me just as long or longer to find the problem--I'm writing it down!

Although it's possible I haven't found other mis-configurations that would result in HW Inv policy causing the client to simply disable the policy completely, in this case the problem was in my additional MOF snippet, in configuration.mof, I was looking for specific regkeys. When you do that, there is the top section which sets up what the values are going to be, and the bottom section tells the client where to go get those values in HKLM.

For example (Note; grabbed this sample from the ConfigMgr MOF snippets at sccmexpert.com, just using them as an example--and I've deliberately messed it up to illustrate the example):

[DYNPROPS]
Class Norton_Symantec
{
[key] string Component;
        string NavPath;
        string NavParent;
        string NavPatternName;
        string LicenseNumber;
        uint32 ParentPattern;
        uint32 PatternFileRevision;
        uint32 PatternFileSequence;
        uint32 ProductVersion;
        string ScanEngineVendor;
        uint32 ScanEngineVersion;
        uint32 UsingPattern;
        string VirusEngine;
        string Nav7SAV8Defs;
        string DefWatch10;
};

//`'`*._.*`'`*-
// Instance of Extended_Norton_Symantec_Anti-Virus
//`'`*._.*`'`*-

[DYNPROPS]
instance of Norton_Symantec

{
Component = "Norton/Symantec AntiVirus Definition File Data";
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Symantec\\InstalledApps|NAVNT"),Dynamic,Provider("RegPropProv")] NavPath;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Intel\\LANDesk\\VirusProtect6\\CurrentVersion|Parent"),Dynamic,Provider("RegPropProv")] NavParent;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Intel\\LANDesk\\VirusProtect6\\CurrentVersion|CurrentPatternName"),Dynamic,Provider("RegPropProv")] NavPatternName;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Intel\\LANDesk\\VirusProtect6\\CurrentVersion|LicenseNumber"),Dynamic,Provider("RegPropProv")] LicenseNumber;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Intel\\LANDesk\\VirusProtect6\\CurrentVersion|ParentPattern"),Dynamic,Provider("RegPropProv")] ParentPattern;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Intel\\LANDesk\\VirusProtect6\\CurrentVersion|PatternFileRevision"),Dynamic,Provider("RegPropProv")] PatternFileRevision;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Intel\\LANDesk\\VirusProtect6\\CurrentVersion|PatternFileSequence"),Dynamic,Provider("RegPropProv")] PatternFileSequence;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Intel\\LANDesk\\VirusProtect6\\CurrentVersion|ProductVersion"),Dynamic,Provider("RegPropProv")] ProductVersion;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Intel\\LANDesk\\VirusProtect6\\CurrentVersion|ScanEngineVendor"),Dynamic,Provider("RegPropProv")] ScanEngineVendor;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Intel\\LANDesk\\VirusProtect6\\CurrentVersion|ScanEngineVersion"),Dynamic,Provider("RegPropProv")] ScanEngineVersion;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Intel\\LANDesk\\VirusProtect6\\CurrentVersion|UsingPattern"),Dynamic,Provider("RegPropProv")] UsingPattern;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Intel\\LANDesk\\VirusProtect6\\CurrentVersion|VirusEngine"),Dynamic,Provider("RegPropProv")] VirusEngine;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Symantec\\SharedDefs|NAVNT_50_AP1"),Dynamic,Provider("RegPropProv")] Nav5Defs;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Symantec\\SharedDefs|NAVCORP_70"),Dynamic,Provider("RegPropProv")] Nav7SAV8Defs;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Symantec\\SharedDefs|DEFWATCH_10"),Dynamic,Provider("RegPropProv")] DefWatch10;
};

Looks fine, right? What could be wrong with that?! After way too much time looking and looking at the lab sample, I finally spotted it. The bottom, the Instance section, is looking for Nav5Defs. But in the top section, I neglected to put in a string Nav5Defs. Fixed that, drop the configuration.mof into the inboxes\clifiles.src\hinv, watch dataldr.log to be sure it's not rejected, a couple of policy refreshes on the client; and about 5 minutes later the Hardware Inventory action came back.

How to gather Monitor Information like Serial Number

skissinger — Fri, 15 Aug 2008 01:00:00 GMT

I see this question arise often enough in the forum. I thought I'd blog what I think I know so I can just point people here instead of retyping!

Before we get to serial number, if the information you are looking for are the Monitor's Manufacturer, or the pixels set (1024x768) that is an existing class in sms_def.mof. Out of the box, those details are on by default.

If for asset tracking reasons you are asked to find monitors by serial number (although sometimes a college student with a clipboard for minimum wage might work just as well!) there are 4 methods I know of. If there are others, I apologize.

In no particular order:

http://www.enhansoft.com, Monitor Information Reporting (MIR)
http://www.toptechnologies.com/prod_edid.aspx?displaylang=en, EDID
http://entechtaiwan.net/util/moninfo.shtm, Monitor Asset Manager
http://www.myitforum.com/forums/m.asp?m=183273, a script

The top 3 are for-pay; just contact each vendor for a demo. The last one is a script -- recently written -- that may do a better job than the previously available monsernum.vbs script. (monsernum.vbs was questionable in my environment) If you decide to go forward with the free one, remember you get what you pay for. It hasn't been thoroughly tested, where the top 3 have been around for years.

Script to set ConfigMgr Client's 'Install required updates on a schedule'

skissinger — Wed, 13 Aug 2008 11:11:00 GMT

This came out of the SDK:

on error resume next
'From ConfigMgr07 SDK
'Parameters:
'First parameter is the day
'0=none, 1=Sunday, 2=Monday, 3=Tuesday, 4=Wednesday
'5=Thursday, 6=Friday, 7=Saturday, 8=Daily
'2nd Paramter is the time, 0 through 23
newRecurrence = wscript.arguments(0)
newHour = wscript.arguments(1)
set updatesDeployment = CreateObject ("UDA.CCMUpdatesDeployment")
updatesDeployment.SetUserDefinedSchedule newRecurrence, newHour
wscript.quit

As examples, NameOfTheScript.vbs 8 03 would be Daily, 3 am. NameOfTheScript.vbs 7 23 would be Saturdays, 11 p.m. If you need to disable the schedule, it's NameOftheScript.vbs 0

If you look at a client, their local Configuration Management applet, on the Updates tab an individual could set a schedule. This script allows you to set that schedule via a vbscript advertisement. I'm hoping (still haven't sent this to production yet, so YMMV) that by implementing this script I can appease the conflicting requirements of allowing for long periods before Software Updates are required, yet set installation times for different computers based on roles and get to 97% hotfix deployment quickly.

User AD Info - Ron Crumbaker Web Console 3.21

skissinger — Wed, 30 Jul 2008 01:19:00 GMT

After seeing Hector's post, that reminded me I had added a similar button to Ron's console. Either one will work. If you notice that results returned from the original query take several seconds, you might want to try this one. I noticed in my environment it was because the script needs to query every domain controller in order to determine last logged in time or last failed login time. I added a prompt asking if they need that information returned. Only if the tech wants that information will every DC be queried otherwise that section is skipped.

Copy machrest.asp elsewhere for paranoia
Edit MachRest.asp, near other button definitions (near the top) (but I suggest under the User Lookup button) add
<input style="WIDTH: 180px" type="button" value="AD Info" name="Btnl735">
Add the contents of the attached .txt near the bottom; just after all of the other Sub / End Sub routines.

ConfigMgr 2007 Mof Snippets for extending Hardware Inventory

skissinger — Thu, 24 Jul 2008 01:38:00 GMT

On www.sccmexpert.com, they have recently posted an update to the Individual MOF collection which was originally for SMS2003. They've been updated to be ConfigMgr - friendly. Go there, click on "The Mof", Mof Tools, then "Get the Scripts" (note; you may have to sign up on their web site--but it's quick & free). Then grab "ConfigMgr MOF Snippets".

With SMS 2003 (and earlier), extending hardware inventory has been essentially the same; you add specifically crafted text to sms_def.mof on the server, and if data objects were needed, you "mofcomp'd" those data object text files on your clients. With ConfigMgr 2007, it is just different enough to possibly be a little confusing. I'll try to clear up any confusion.

In ConfigMgr 07, on the server in inboxes\clifiles.src\hinv, there are two mof files: sms_def.mof and configuration.mof

You can of course leave them alone, but if you've 'extended hardware inventory' with SMS2003, or you've heard of doing this and want to do so, in a nutshell, in sms_def.mof if you were to add specifically crafted text to the bottom-- specifically the bits that make up the "Report" section, (the section with TRUE or FALSE in them), that would update the Hardware Inventory policy which your MPs offer to clients. Once the clients pick up that from the MP, their next Hardware Inventory they'll try to report.

In configuration.mof at the bottom, you would add the bits that make up the "data" section. I like to think of it as "telling the client how to report on what the policy is asking for". For example, the Hardware Inventory policy may ask for McAfee AntiVirus information, because you just added that snippet to the bottom of sms_def.mof. But a client won't know "how" to report on that custom data without instructions. Configuration.mof is where you tell the client to pull that information from 'these specific registry keys'.

If you're just starting out with ConfigMgr, you can ignore these next 2 pieces of information... If you're a SMS2003 admin, just a couple things to help clear things up. #1) Mofcomp. Forget about it. You know what I'm talking about! Configuration.mof does all the work for you. #2) In the snippets, you may notice a decided lack of a line you were used to seeing in the mof snippets for SMS2003, the #pragma namespace lines. Since sms_def.mof is now only for cimv2/sms namespace, and configuration.mof is only for the cimv2 namespace, those lines to tell the mof "The next section is for this namespace" are just redundant and not needed.

Outlook 2003 - Locally saved .oft Organizational Forms Library forms cannot be opened

skissinger — Fri, 11 Jul 2008 15:31:00 GMT

Issue: Outlook 2003, New, Form, Choose Form, from Organizational Forms Library, you pick a form and it Opens fine. You choose File, Save As, and save the form as an .oft file locally. Subsequent attempts to double-click the form from the local location result in an error "The custom form could not be opened. Outlook will use an Outlook form instead."

Fix: There are 3 HKCurrentUser keys that need to be present in order for this behavior to work correctly. However, note that Microsoft "doesn't recommend" setting these regkeys. Therefore, only set them upon request.

HKCU\Software\Microsoft\Office\11.0\Outlook\Options\Mail\ AllowMSGFilestoCreateProps DWORD value of 1
HKCU\Software\Microsoft\Office\11.0\Outlook\Options\Mail\ AllowTNEFtoCreateProps DWORD value of 0
HKCU\Software\Microsoft\Office\11.0\Outlook\Security\ AllowActiveXOneOffForms DWORD value of 2

Following setting the regkeys, a logoff/on may be required before the regkeys are valid.

One way to replace the hardware for a Secondary Site

skissinger — Thu, 10 Jul 2008 02:53:00 GMT

If you've got the political climate I do, where the corporate policy is to work on production server replacements during off hours, and that conflicts with your personal policy of "get to bed sometime before 1 am would be great", I've used this method for several Secondary Site hardware lease returns; my personal best time was 2.5 hours, but it usually takes me ~4 hrs (presuming all the 'prior to shipping hardware' tasks could be done ahead of time. I've used this method extensively w/SMS2003, haven't had a chance to test it yet w/ConfigMgr.

Tools needed:

Preinst.exe from SMS 2003 Toolkit 2 http://www.microsoft.com/smserver/downloads/2003/tools/toolkit.mspx
PreLoadPkgonSite also from SMS 2003 Toolkit 2
CloneDP, installed (pre-req of .Net 2) http://sourceforge.net/projects/smsclonedp/
Script or method to enumerate .pkg files in X:\smspkg
MPTroubleshooter also from SMS2003 Toolkit 2

Resources needed locally on the new server:

SMS 2003 Setup files
If secondary is to be a proxy MP, setup files for the Operating System
Restored or copied from old server, X:\smspkg
Restored or copied from old server, X:\smspkgx$ ** (Any steps marked with a ** are optional, see footnote)

Resources needed remotely:

Rights and ability to remote into any primary sites above the secondary site to be replaced.

Timeline - There are 4 time frames

Tasks that can done before the new hardware is shipped to the destination; but could also be done once hardware arrives at new location.
Tasks done after the new hardware has arrived.
Work done after SMS 2003 reinstalled
Follow up the next day.

Prior to shipping hardware

From a local Distribution Point, copy \\otherserver\x$\smspkg to x:\smspkg
From a local Distribution Point, copy \\otherserver\x$\smspkgx$ to x:\smspkgx$ **
Copy SMS 2003 setup files to x:\SMSTools\setup
Copy PreloadPkgonSite.exe to x:\SMSTools
Copy PreloadBuild.vbs to x:\SMSTools

The above steps could also be done once the hardware arrives at the destination, or restored from backup--if you backup your secondary (which we don't normally)

Hardware arrived

Optional: if you copied smspkg & smspkgx$ over from ServerOld to ServerNew a significant time ago, you may want to do a Delta copy just before starting. Otherwise, if you preloadpkgonsite of an old version of a pkg file, those packages will need to be re-replicated from the parent.
On Current Server, Disable the SMS Services so they do not launch automatically following a reboot.
Rename current Server to ServerName_OLD, change IP address from static to dhcp. Reboot.
On new hardware, rename to ServerName, change IP from dhcp to static. Reboot.
Install IIS with BITS. If IIS had been installed under the old name, uninstall IIS, then reinstall IIS. This is to ensure the iis usernames are defined correctly.
Follow the EdNet instructions for removing the Secondary Site from the Primary Site(s) databases, and deleting any jobs. These instructions use the preinst.exe toolkit tool at the Primary Site, and Query Analyzer. (http://www.myitforum.com/articles/1/view.asp?id=5355)
Remove the SMS entries for the server in Active Directory for the server itself, and for the MP record. (in the OU System\System Management, SMS-Site-xxx, and SMS-MP-xxx-ServerName)
At the Primary Site(s), remove the Standard Sender Address for the secondary site. Wait a minute or so.
At the Primary Sites(s), create a new Standard Sender Address for the secondary site.
At the secondary site, unshare smspkge$ & rename to smspkge_old (you’ll move files later)**
At the secondary site, install SMS from smstools\...\setup.exe, Advanced Security, Remote Tools enabled.
Monitor sms\logs\*.log files for errors
Monitor Active Directory Users and Computers, the OU System/System Management, for SMS-Site-Rxx to appear.
At the direct Primary site, refresh Site hierarchy occasionally. When you see the site reappear, configure boundaries, Addresses, client Agents, Discovery Methods. Configure Site Systems to be a Management Point, and Distribution Point with BITS.
At the secondary site, monitor sms\logs\mpsetup.log for success/failure.
If failed, stop and troubleshoot. Multiple problems can occur with this step. Too many to detail here.
If success, run the MP troubleshooter to verify.

SMS Reinstalled

Push down 1 (smallish) package. Monitor the Secondary Site recreating smspkge$ share, and putting the new package in there.
Highlight all the folders in smspkge_old, and verify the ntfs permissions match what they should be in the new smspkge$. Reset as necessary. Once satisfied permissions are correct, Move all the folders (except the new one you just had rebuilt) to the new smspkge$. You can delete smspkge_old when done (there should only be 1 folder left). **
At the secondary, go to a command prompt. CD to x:\smspkg Pick 1 package. Type in x:\smstools\preloadpkgonsite PackageID (without the .pkg extension, i.e., x:\smstools\preloadpkgonsite TST00012)
A success message looks like this:
Forward package status for pkg C0100012 to site C01
****** Successfully set the Compressed Package Path on this site ******
****** Successfully forwarded the information up the hierarchy ******

If you got a different message (a failure message), try a different package. If all Packages fail, you may need to check that *.pkg are all Read-only.
Following the success message, monitor distmgr.log on the Secondary to confirm that package's info has been sent.
At the Central Site, add the (new) Secondary site distribution point to that 1 package.
Monitor Sender.log at the server(s). Monitor Package Status at the Primary Site server(s).
Once you are satisfied the process works, use this script to create a batch file in e:\smspkg to run preloadpkgonsite against all the .pkg files.
Create a preloadbuild.vbs file with the below in e:\smstools. Then start, run wscript e:\smstools\preloadbuild.vbs
The script (correct the variables for your environment/server; the E: drive may not be correct for you):

set fso = wscript.CreateObject("Scripting.FileSystemObject")
set fo = fso.getFolder("e:\smspkg")
set fc = fo.Files
set TheFile = fso.createtextfile("e:\smspkg\preload.bat",True)
For each file in fc
TheArray = Split(file,"\", -1, 1)
StrNameToLoad = Left(TheArray(2),8)
theFile.writeline "e:\smstools\preloadpkgonsite " & strNameToLoad & " >> e:\smstools\preload1.txt"
next
TheFile.Close
Now that you have a e:\smspkg\preload.bat, go to a cmd prompt, and switch to e:\smspkg. Type in preload.bat, and wait.
When it is done, open up e:\smstools\preload1.txt and verify the majority of the entries are “successfully forwarded”. It’s OK if there are a few errors, but if all are errors, there may be a problem.
Watch distmgr.log on the secondary; wait for it to complete sending up packages (how long depends upon how many packages you have, this can take quite a while for me).
After waiting, add the new DP to a package at the Central Site, and confirm via watching sender.log that the entire package is indeed NOT being replicated downward.
Once you’ve confirmed that, run CloneDP, and pick a similar Secondary Site to Clone to the new one. It may take quite a while for CloneDP to go through the entire list of packages to Clone. This is normal; just wait.

CloneDP usage

Launch
SMS Primary Site Server = your Primary Site Server that has the packages, OK
Select an existing Distribution Point, pick a Site Code, a DP, drag & drop the server name to the Packages Source List
Select Destination of the new site
Click “Assign Packages to DP”.
This is the point where "waiting" begins; or the "go to bed and check on it in the morning" step!

Follow up the Next day

The following day, check Package Status. For any packages that appear not to have worked, you may need to update all Distribution Points for that 1 package.

** Why are these optional? In our environment, if for some reason there is an "emergency" software installation which may need to occur before a Secondary can be fully rebuilt, the local technicians can browse to the smspkgx$ share, the folder, and manually install software. For that reason, we copy over the smspkgx$ folders, etc. As SMS unpacks the .pkg files into smspkgx$, the folders are replaced.

MVP - 2008

skissinger — Tue, 01 Jul 2008 16:52:00 GMT

I got an email (anxiously awaited for) that I've been awarded MVP status for another year. I'm honored to be among such excellent company. If you look at the list, most of them have written books, tools, or devote a good chunk of their lives to running a web site.

Security Certificates, Trusted Publishers, and ClickOnce Apps

skissinger — Fri, 20 Jun 2008 21:24:00 GMT

The real author of this entry is Steve Grinker (he doesn't have a blog yet, I'm trying to convince him to get one here). By the way, Steve, yes, your name is going to be prominently displayed until you do get a blog. So you might as well get one so I stop nagging you.

Issue: We have an internally written Click-once application, with signed Infopath forms. If we put the cert in GPO, it would be added to the "Trusted Root Certication Authorities" store and trusted by the application, but once you used one of the signed Infopath forms, the user was prompted with an error that resolved to the form not properly being trusted. We needed a way to automatically get the cert into the "Trusted Publishers" store. Since this solution took several people in my team, the Internal Development team, and a call to MS, we're blogging this.

Resolution: Running this script as an advertisement via SMS, system context. The source folder contains the 4 files: the vbscript itself, certadm.dll & certutil.exe from our cert server, and the certificate.cer file.

The script copies certadm.dll to the local computers' system32 folder, and registers the .dll, then this command is run:

certutil.exe -enterprise -addstore "TrustedPublisher" certficate.cer

That places the .cer into the Trusted Publishers' area, so the end user no longer gets any prompts, from either the ClickOnce app, nor when launching an individual infopath form.

On Error Resume Next
Set sho = Wscript.CreateObject("Wscript.Shell")
Set FSO = CreateObject("Scripting.FileSystemObject")
strCurrentDir = Left(Wscript.ScriptFullName, (InstrRev(Wscript.ScriptFullName, "\") -1))
Set strSysFolder = FSO.GetSpecialFolder(1) 'get system32 folder
'Copy the dll to the system folder
FSO.CopyFile strcurrentdir & "\certadm.dll",strSysFolder & "\"
'Register the dll
sho.Run "cmd.exe /c regsvr32.exe /s " & Chr(34) &_
strSysFolder & "\certadm.dll" & Chr(34),0,vbTrue
intret = sho.Run(strcurrentdir & "\certutil.exe -enterprise -addstore " & Chr(34) &_
"TrustedPublisher" & Chr(34) & " " & strCurrentDir & "\certificate.cer",0,vbTrue)
wscript.quit(intret)

fyi, the production script also contains some regkey tags I'm tracking with a MOF edit, so we can target computers that haven't registered the cert, but that's not pertinent to this blog entry

Supposedly this might all get easier with Vista and Server 2008, but per Microsoft there is no current way to address this with a GPO in XP. We even tried some updated ADM files with no positive results.

Report on Local Administrators Group membership - updated

skissinger — Mon, 09 Jun 2008 00:11:00 GMT

Ward Lange's original mof edit works great for 2000 and xp; but for Windows 2003 servers and Vista, the "BUILTIN" needed to be replaced with the local computer's name. Unfortunately, I have yet to hear of a way to use a dynamic variable in the MOF.

Mike Seely posted a script on the forum. With his permission I've used it to show a different method to gather the contents of the local Administrators group.

Edit inboxes\clifiles.src\hinv\sms_def.mof. At the very bottom, add these lines. These are identical to Ward Lange's mof edit, so if you've already implemented that one, no need to change anything.
[ SMS_Report (TRUE),SMS_Group_Name ("LocalAdmins"),SMS_Class_ID ("MICROSOFT|LocalAdmins|1.0")]
class Win32_LocalAdmins : SMS_Class_Template
{
[SMS_Report(TRUE), key] string AccountName;
[SMS_Report(TRUE), key] string GroupName;
};
Do not add anything to Configuration.mof. If you've previously implemented Ward Lange's, remove the section from configuration.mof. If you are on SMS2003 (not configMgr) and have already implemended Ward Lange's edit, you will want to remove the data section, leaving just the reporting section (the section above).
Attached is a .txt file; rename it to .vbs. Place it in a Source folder, and create a package/program for it, to run whether or not user logged in.
The Collection Query I suggest using for the advertisement is this, I'd set it to be recurring every few days so if a machine loses the WMI information somehow, it gets it back.

select SMS_R_SYSTEM.ResourceID
from SMS_R_System
where
SMS_R_System.ResourceId not in
(select SMS_R_System.ResourceId
from SMS_R_System
inner join SMS_G_System_LOCALADMINS on SMS_G_System_LOCALADMINS.ResourceID = SMS_R_System.ResourceId
where SMS_G_System_LOCALADMINS.AccountName is not null)

So, what does this combination do? The sms_def.mof edit will set your hardware inventory policy to report on local administrators group membership. The vbscript advertisement will create the WMI data entry using the computer name. It doesn't really matter if configuration.mof built it or something else built it--once it's there, Hardware Inventory policy will be able to use it.

A sample report to use once you have this data:

select distinct Name0 as 'Computer Name', substring(AccountName0,charindex('Domain=',Accountname0)+8,(charindex('Name=',Accountname0)-charindex('Domain=',Accountname0)-10)) as 'Domain Name', substring(AccountName0,len(AccountName0)-charindex('"',reverse(AccountName0),2)+2,charindex('"',reverse(AccountName0),2)-2) as 'User Name'
from v_GS_SYSTEM INNER JOIN v_GS_LocalAdmins ON v_GS_SYSTEM.ResourceID = v_GS_LocalAdmins.ResourceID where (AccountName0 not like '%Administrator%' AND AccountName0 not like '%Domain Admins%')

Note 1: The vbscript specifically looks for members of the 'Administrators' group. If you have alternate groups you need to look for, like Administrateurs, or Administraten, modify the script.

Note 2: The vbscript is currently specifically for x86; it will need adjusting to work on x64 OS'

Original article (includes screenshots of what the sample report looks like): http://www.myitforum.com/articles/8/view.asp?id=9735

MDT 2008 Tattoo mof edit

skissinger — Fri, 30 May 2008 21:44:00 GMT

By request, and untested, the tattoo placed in the registry for the HKLM\software\deployment 4\Deployment Method string regkey.

//`'`*._.*`'`*-
// Reporting Class - for ConfigMgr, put this section in sms_def.mof
//`'`*._.*`'`*-

[SMS_Report(TRUE), SMS_Group_Name("MDT2008 Tattoo"),SMS_Class_ID("Microsoft|MDT2008_Tattoo|1.0")]
class MDT2008_Tattoo : SMS_Class_Template
{
[SMS_Report(TRUE),key] string KeyName;
[SMS_Report(TRUE)] string DeploymentMethod;
};

//`'`*._.*`'`*-
// Data Class - for ConfigMgr, put this section in configuration.mof
//`'`*._.*`'`*-

[DYNPROPS]
class MDT2008_Tattoo
{
[key] string Keyname="";
string DeploymentMethod;
};

[DYNPROPS]
instance of MDT2008_Tattoo
{
KeyName = "MDT2008 Tattoo";
[PropertyContext("local|HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Deployment 4|Deployment Method"),
Dynamic,Provider("RegPropProv")] DeploymentMethod;
};

NOTE: The above was formatted for ConfigMgr, if you are on SMS2003 remember to add in #pragma namespace("\\\\.\\root\\cimv2\\SMS") under the // Reporting class comment, and #pragma namespace(\\\\.\\root\\cimv2) under the //Data class comment. Under sms2003, those #pragma namespace entries are to inform WMI where the following lines reference. In ConfigMgr, sms_def.mof is only for stuff in root\cimv2\sms, and configuration.mof is only for stuff in root\cimv2, so you don't have to repeat yourself. It won't hurt it to put in it, but it's kind of redundant.

McAfee 8.x Enterprise sms_def.mof Edit - ConfigMgr

skissinger — Thu, 15 May 2008 16:34:00 GMT

I had a blog entry for SMS2003; but now that I'll be soon going to production w/ConfigMgr myself, thought I'd share some of the edits.

As you may or may not know, the main differences between SMS 2003 and ConfigMgr 07 are:

No more need to mofcomp on the clients
sms_def.mof is for the Reporting classes (what makes up the policy that the clients pick up from the MP)
configuration.mof is for the Data classes (what the clients auto-compile when changes are detected, like this one)
No more need to add the #pragma namespace("\\\\.\\root\\cimv2") or #pragma namespace("\\\\.\\root\\cimv2\sms"); because you are no longer switching between data & reporting classes within the same mof file.

With that in mind, below are what you would add to sms_def.mof and configuration.mof on your primary site servers' inboxes\clifiles.src\hinv in order to enable reporting on McAfee 8.x and EPO 3.x

Add to SMS_Def.mof, at the bottom

// <:[-<>>>>>>>>>>>>>>>>>>>Start>>-Network Associates/McAfee Anti-Virus-<<Start<<<<<<<<<<<<<<<<<>-]:>
//`'`*._.*`'`*-
// McAfee Reporting Class
//`'`*._.*`'`*-
[SMS_Report(TRUE),SMS_Group_Name("McAfee_Virus_Scan"),SMS_Class_ID("SMSExpert|McAfee_Virus_Scan|1.0")]
Class McAfee_Virus_Scan : SMS_Class_Template
{
[SMS_Report(TRUE),key] string KeyName;
[SMS_Report(TRUE) ]     string szCurrentVersionNumber;
[SMS_Report(TRUE) ]     string szDatVersion;
[SMS_Report(TRUE) ]     string szEngineVer;
[SMS_Report(TRUE) ]     string szEngineVerMinor;
[SMS_Report(TRUE) ]     string szDatDate;
};
// <:[-<>>>>>>>>>>>>>>>>END>>-Network Associates/McAfee Anti-Virus-<<END<<<<<<<<<<<<<<>-]:>
// <:[-<>>>>>>>>>>>>>>Start>>-Network Associates/McAfee ePO Agent-<<Start<<<<<<<<<<<<<<>-]:>
//`'`*._.*`'`*-
// McAfee ePO Agent Reporting Class
//`'`*._.*`'`*-
[SMS_Report(TRUE),SMS_Group_Name("McAfee_ePO_Agent"),SMS_Class_ID("SMSExpert|McAfee_ePO_Agent|1.0")]
Class McAfee_ePO_Agent : SMS_Class_Template
{
[SMS_Report(TRUE),key] string KeyName;
[SMS_Report(TRUE) ]    string szePOVersion;
[SMS_Report(TRUE) ]    string szePOName;
[SMS_Report(TRUE) ]    string szePOGUID;
[SMS_Report(TRUE) ]    string szePOInstallPath;
};
// <:[-<>>>>>>>>>>>>>>>>END>>-Network Associates/McAfee ePO Agent-<<END<<<<<<<<<<<<<<>-]:>

Add to Configuration.mof, at the bottom

// <:[-<>>>>>>>>>>>>>>>>>>>Start>>-Network Associates/McAfee Anti-Virus-<<Start<<<<<<<<<<<<<<<<<>-]:>
//`'`*._.*`'`*-
// McAfee Data Class
//`'`*._.*`'`*-
[DYNPROPS]
Class McAfee_Virus_Scan
{
[key] string KeyName="";
        string szCurrentVersionNumber;
        string szEngineVerMinor;
        string szDatVersion;
        string szEngineVer;
        string szDatDate;
};
//`'`*._.*`'`*-
// Instance of McAfee for Enterprise 8.5
// Contributed by Jane McLeish/Sherry Kissinger
//`'`*._.*`'`*-
[DYNPROPS]
instance of McAfee_Virus_Scan
{
KeyName="McAfee Enterprise 8.5";
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\McAfee\\AVEngine|EngineVersionMajor"), Dynamic, Provider("RegPropProv")] szEngineVer;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\McAfee\\AVEngine|EngineVersionMinor"), Dynamic, Provider("RegPropProv")] szEngineVerMinor;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\McAfee\\AVEngine|AVDatVersion"), Dynamic, Provider("RegPropProv")] szDatVersion;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\McAfee\\DesktopProtection|szProductVer"), Dynamic, Provider("RegPropProv")] szCurrentVersionNumber;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\McAfee\\AVEngine|AVDatDate"), Dynamic, Provider("RegPropProv")] szDatDate;
};
// <:[-<>>>>>>>>>>>>>>>>END>>-Network Associates/McAfee Anti-Virus-<<END<<<<<<<<<<<<<<>-]:>
// <:[-<>>>>>>>>>>>>>>Start>>-Network Associates/McAfee ePO Agent-<<Start<<<<<<<<<<<<<<>-]:>
//`'`*._.*`'`*-
// McAfee ePO Agent Data Class
//`'`*._.*`'`*-
[DYNPROPS]
Class McAfee_ePO_Agent
{
[key] string KeyName="";
        string szePOVersion;
        string szePOName;
        string szePOGUID;
        string szePOInstallPath;
};
//`'`*._.*`'`*-
// Instance of McAfee ePO 3x
//`'`*._.*`'`*-
[DYNPROPS]
instance of McAfee_ePO_Agent
{
KeyName="McAfee ePO 3.x";
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\ePolicy Orchestrator\\Agent|Installed Path"),Dynamic,Provider("RegPropProv")] szePOInstallPath;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\ePolicy Orchestrator\\Application Plugins\\EPOAGENT3000|Version"),Dynamic,Provider("RegPropProv")] szePOVersion;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\ePolicy Orchestrator\\Agent|ComputerName"),Dynamic,Provider("RegPropProv")] szePOName;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\ePolicy Orchestrator\\Agent|AgentGUID"),Dynamic,Provider("RegPropProv")] szePOGUID;
};
// <:[-<>>>>>>>>>>>>>>>>END>>-Network Associates/McAfee ePO Agent-<<END<<<<<<<<<<<<<<>-]:>

MMS2008 - Thursday 1

skissinger — Fri, 02 May 2008 00:43:00 GMT

Session: Device Management on ConfigMgr. It was interesting; but since we're 99.9% blackberries, and with SC Mobile Manager; I think if we're going to go with a management product, probably we'd go with Mobile Manager. Although maybe (if time permits), deploy just the inventory piece, just so we know what's out there.

Session: SUS in ConfigMgr.

Session: Case Studies Deep Dive. Some good tips on log files to check, utilities to use (procmon) when troubleshooting an issue. Pointed out a script for refreshingServerComplianceState if you happened to have accidentally deleted a record in the console--to get installed hotfixes reported correctly, you may need to deploy that to those clients. A good walkthrough on what log files to hit when tracing a SW distrib.

My favorite (because sms_def.mof/configuration.mof were mentioned, I'm such a geek): reporting stuff go in sms_def.mof, new classes go into configuration.mof. I've actually seen that 2-3 times from people either in the forums or email to me; where they are trying a new mof snippet, and their Hardware Inventory Action disappears from the client's Agent listing. That happens because technically the mof snippet added passes a mofcomp -check, so it is compiled successfully, but it confuses the client; so the client just gives up on HW Inv.

Another good one... when the firmware on the client computer isn't up-to-date, and the end user turns off their computer by holding in the power button for several seconds; the WOL magic packet "doesn't work". The read-between-the-lines I got out of that was </sarcasm on> 'of course ConfigMgr is broken' </sarcasm off> :-) . The fix was to update the bios firmware and/or change the BIOS setting of "when holding down the power button, go into suspend, not power off". The presenter mentioned that other computers doing start/shutdown worked just fine in this company. Apparently, the train-the-user how to click Start, Shutdown to politely shutdown their computer was not an option for this particular call. *shrug* I'm guessing that the solution of 'problem is between the chair and the computer' wasn't a politically correct response. :-)

Tonight: the closing party. If I remember right it's "themed bars" (whatever that means), and Xbox Rock Band competitions. Since the MyItforum booth had RockBand available for people to practice on for tonight... I'm hoping for a couple good "bands"!

MMS2008 - Wednesday 3

skissinger — Thu, 01 May 2008 13:48:00 GMT

Session: Ask the Experts; and interesting solution by Rod K to a question; the question was sending out a wakeup, then a task (like anti-virus scan), then shutdown; but only shutdown those computers that had to be woken up. Other than the obvious (1E / sccmexpert or other 3rd party tools to manage that), he mentioned scripting finding win32_computersystem.wakeuptype, and if value is 5, shutdown the computer after the virus scan is complete. (because 5 is wakeonlan, and 6 is the power button)

MMS2008 - Wednesday 2

skissinger — Thu, 01 May 2008 13:36:00 GMT

Session: Console Extensions (right-click) for ConfigMgr

Greg pointed out Rick Houchin's existing toolset, as well as reminding everyone about KB932303. Also http://www.myitforum.com/articles/42/view.asp?id=10801, for converting any existing right-click tools you may have for SMS2003 to ConfigMgr

Remember /sms:nodeinfo=1 for the old console? Greg mentioned there are several switches for the new console that can assist you in scripting your own console extensions. A few were sms:debugview, sms:verboseerrors, sms:namespaceview=1; there were 1 or 2 more, check out http://technet.microsoft.com/en-us/library/bb693533.aspx.

Some great powershell demos; Greg mentioned he'll blog the scripts he used for the demos, so I'll just wait for those.

MMS2008 - Wednesday 1

skissinger — Thu, 01 May 2008 13:28:00 GMT

Keynote: A few announcements (probably mostly known): ConfigMgr 07 SP1 in May, R2 (release candidate) in July. An update to Desktop Optimization Pack in Q3 2008; as a subscription service anticipate updates every 6 months.

A demo of the R2 Out of Band Management Console to (for example) remotely look at bios and change settings.

A demo of in-development product, Asset Knowledge Service. They announced that anyone can ask to join, so if anyone might be interested in participating--your company would need to be willing to forward data upstream to Microsoft (they didn't explain it like this, but I equated the process involved to be similar to that question you see when a driver doesn't load correctly, or a app crashes of "send this information to Microsoft yes/no"). If you might want to join, email knowledge@microsoft.com .

MMS 2008 - Tuesday 2

skissinger — Wed, 30 Apr 2008 04:09:00 GMT

Session: Advances in SMS & ConfigMgr Client Health Management. Very good presentation; I won't repeat it here because it was Paul Thompson, and it's all on his blog already, or he said he'll be posting the missing bits soon. He also mentioned a 1e product, coming out this summer, Wakeup 5.5 which does have some client remediation.

A lab on DCM; then caught the last half of Wally Mead's ConfigMgr07 Part II. The main point I got out of that (because he mentioned it several times) was to implement a Fallback Status Point (FSP); and (this is the part apparently forgotten by many), in their installation line make sure to reference what that FSP is, so during client installation, messages are sent to the FSP. He also demo'd (accidentally, I believe--he forgot to set it up in his demo before starting), setting verbose log to 1 for HKLM\software\microsoft\sms\data discovery manager\ verboselogs; this enabled your ddm.log to show the computer name in the log; not just "computer successful" entry.

Session: Community. Mention was made of a Codeplex based offline reader. People were reminded of Connect, and a virtual usergroup "systemcenterusergroup.com" mentioned.

MyITForum party: as always, it was fun reconnecting with people. Also lost of new people got buttons, so it was great to meet new people, both to MMS and to Myitforum.

MMS2008 - Tuesday 1

skissinger — Tue, 29 Apr 2008 17:07:00 GMT

Keynote. Dynamic Datacenter. There was a demo of task sequencer & custom tasks for deploying servers & their roles (like AD, HyperV enabled).

A couple of announcements, Virtual Machine Manager 2008 Beta, which will watch/manage ESX/Vmware as wall as VMMs; and that it's all powershell scripts on the backend. Also the Beta of Cross Platform Extensions for OpsMan available today. They had DVDs to hand out; so I wasn't clear if the download is available today already or not. These Cross Platforms extensions demo illustrated managing a unix system (troubleshooting and fixing) from within OpsMan, without having to shell out to your unix box.

MMS2008 - Monday 3

skissinger — Tue, 29 Apr 2008 13:06:00 GMT

The expo! I didn't arrive in the expo until about 20 minutes after the doors opened, so I was not witness to the "race for the button", but I heard it was impressive again; with some newer attendees not knowing why this collection of technical geeks are that excited about an expo, and some vendors (who weren't in attendance last year) confused--what in the world is that booth giving out!?

Swag: a very nice luggage tag from Myitforum, a couple of demo DVDs/CDs, a squishy Octopus, a shirt. I didn't go swag-nuts, although I did see several people with their bags stuffed w/swag! Signed up for a few of the contests; checked out some of the new vendors. But mostly, it was about (for me) wandering around, trying to recognize faces from previous years, or literally looking at people's badges and recognizing them from their names/posting.

MMS2008 - Monday 2

skissinger — Tue, 29 Apr 2008 12:38:00 GMT

SQL query tuning; with Brian Mason and John Nelson (number 2)

It was mostly demo; which was great. Especially for newer SMS admins, where SQL is not your first technical expertise (even for supposed old timers, like me, where I just stumble along, and lean heavily on sql experts out there), the demo of Query Analyzer & using views was useful.

After that demo, which they were careful to point out took ~5 minutes, John pointed out several steps to take to optimize the query, like:

Reduce the # of joins, if possible. For example, the same information is often available in multiple views.
If possible (sometimes it is not), if you are using a % or _ for a wildcard in "where something.whatever0 like .." statement, try not to put the % or _ at the front of the search phrase. I.e., if you are looking for Adobe products, try to use Adobe%, not %Adobe%.
Avoid Functions in the where clause, i.e., where something.whatever0 UPPER like ..."
Return only the columns and rows you need (no select *)
And my personal favorite, use indexed fields (or even create indexes -- with the assistance of your SQL DBA, because you'll lose them in an upgrade) for your where clauses. The example was in v_gs_system, netbios_name0 is indexed, and name0 is not. Use the indexed field for faster searching.

During the demo, highlighted a few SQL query building tips, like going to wangz.net, SQLFormatter. After you've built your query (and tested it), use that free web tool to reformat your query into an easier to read syntax. They also mentioned (and I've been guilty of this), when using aliases, like v_gs_system sys, I should really use v_gs_system as sys -- it's compliant to some kind of standard...

When in Query Analyzer, click "Ctrl+L" to see the "cost" of your query. That way you can find any bottlenecks, like searching on %adobe%; if you switch it to adobe%, you'll shave off some execution time.

Ctrl + R, and Shoft + Alt + Enter to toggle some QA visual modes.

After optimizing the query (and switching to a database that had a non-indexed field indexed), the query which used to take 5 minutes to run, took less than 5 seconds!

They also shared their reasoning for deciding to use x64 OS, and x64 SQL 2005 SP2 for their ConfigMgr07 rollout; and why they'll not have SQL on a separate box.

MMS2008 Monday 1

skissinger — Tue, 29 Apr 2008 12:12:00 GMT

Registered early; got the cool bag -- very nice, with a PowerShell book included and the empty bottle for water.

Noon lab with Wally Mead on WSUS w/ConfigMgr 2007. I had played w/doing those tasks in my lab several times, but it's always good to have a lab w/Wally. You can always count on him to highlight the log files to watch (I'm a big log file watcher; although I do prefer trace32 (sorry Wally!))

First breakout I attended was the Docs team, where they highlighted some of there recent offerings:

Superflow ; and shared that the next ones will be in Silverlight. (queue'd up: more Software Update ones, OSD (pxeboot), DCM, NAP, and navigating the Console itself.
Feature Quizzes
Local Help Hotfix
VMM and OpsMan how-to videos
Operations Manager "Jam" site (sorry, no link); will be a way to allow multiple resources to share custom content.
Community Annotation on MSDN & Technet
System Center Content Search gadget - they demo'd it; and it was very cool. [Edit: thanks Greg, so that's where it is!]

They also announced several off-conference sessions asking for more feedback, and opportunities to see some of the new stuff Tuesday and Wednesday.

MMS2008 - Sunday

skissinger — Tue, 29 Apr 2008 12:04:00 GMT

I won't be blogging as often as I was last year -- I decided not to drag my laptop around w/me this year -- but I'm still going to post when I can.

For Sunday, as just a regular attendee there was little to actually sign up for and do; just wandered around the conference center to familiarize myself with where CommNet was, and the Alumni lounge.

Tried to meet up w/the Myitforum'ers at "La Scena Lounge"; unfortunately it was closed due to a Baccarat tournament. Nevertheless met up with a person I've seen at MMS for several years, and we hung out and caught up for a while before decending on Zeffrino's to have a drink and wait for the 6:30 party.

That party was great! it was crowded because it was a smallish bar, but there were Microsoft people, smsexpert people, veterans of MMS and several first timers. It was really nice.

Inventory WindowsFirewall policy

skissinger — Tue, 22 Apr 2008 05:56:00 GMT

Ken Lutz forwarded me this mof edit that he's using; it reads and reports on a registry key:

// <:[-<>>>>>>>>>>>>>>>>>>>>>>>>>>>-Windows Firewall-<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>-]:>
// Contributed by Ken Lutz
// If ConfigMgr, this section goes in configuration.mof
#pragma namespace( "\\\\.\\root\\cimv2" )
#pragma deleteclass("Win32_WindowsFirewallStatus", NOFAIL)

[
dynamic,
provider("RegProv"),
ClassContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall")
]

class Win32_WindowsFirewallStatus
{
[key]
string Component = "Windows Firewall Status";
[PropertyContext("EnableFirewall")]
uint32 Enabled;
};

// if ConfigMgr, this section goes in sms_def.mof

#pragma namespace( "\\\\.\\root\\cimv2\\sms" )
#pragma deleteclass("Win32_WindowsFirewallStatus", NOFAIL)

[
SMS_Report(TRUE),
SMS_Group_Name( "Windows Firewall Status" ),
SMS_Class_ID( "MICROSOFT|WindowsFirewallStatus|1.0" )
]

class Win32_WindowsFirewallStatus : SMS_Class_Template
{
[ SMS_Report( TRUE ), key ] string Component;
[ SMS_Report( TRUE )] uint32 Enabled;
};
// <:[-<>>>>>>>>>>>>>>>>>>>>>>>>END>>-Windows Firewall-<<END<<<<<<<<<<<<<<<<<<<<<<<<<>-]:>

Enabling Inventory for Environment Variables - SMS2003/ConfigMgr

skissinger — Wed, 05 Mar 2008 18:48:00 GMT

I often receive queries about extending the MOF to pull in regkeys. Occasionally, those regkeys happen to be located in HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment

Instead of creating a custom mof edit to pull in a value contained in that regkey; most Environment variables are also stored in WMI, in win32_environment; and the default sms_def.mof does have an existing segment to pull in those values. By default, that segment is set as FALSE . To enable inventorying of Environment variables:

For paranoia, backup \inboxes\clifiles.src\hinv\sms_def.mof
Using a log file viewer, (like trace32.exe from the sms toolkit), open up sms\logs\dataldr.log
edit sms_def.mof using notepad
Search for "Environment" and change that section from having FALSE to be TRUE for at least the following. They can all be TRUE; but (at least for me) those additional values were not useful for the queries and reports I needed.

[ SMS_Report (TRUE),
SMS_Group_Name ("Environment"),
SMS_Class_ID ("MICROSOFT|ENVIRONMENT|1.0") ]

class Win32_Environment : SMS_Class_Template
{
    [SMS_Report (FALSE)     ]
        string     Caption;
    [SMS_Report (FALSE)     ]
        string     Description;
    [SMS_Report (FALSE)     ]
        datetime   InstallDate;
    [SMS_Report (TRUE), key]
        string     Name;
    [SMS_Report (FALSE)     ]
        string     Status;
    [SMS_Report (TRUE)     ]
        boolean    SystemVariable;
    [SMS_Report (TRUE), key]
        string     UserName;
    [SMS_Report (TRUE)     ]
        string     VariableValue;
};

Save sms_def.mof, monitor dataldr.log for any errors. It is highly unlikely that there will be any--this is just a policy change from FALSE to TRUE, but I'm trying to teach you good habits!

You have now triggered a Hardware Inventory Policy change. You now simply need to wait--you are waiting for this policy to be compiled and forwarded to your Management Points, and then you are waiting for your clients to pick up this policy change, and then for the clients to run a Hardware Inventory action, using the new policy, and forward the new information to SMS or ConfigMgr. How long those actions take depends upon your SMS/ConfigMgr environment.

If you are impatient, you can spot-check a test client by:

Wait a few minutes for the policy change to be complied and forwarded to your Management Points
At a client, perform a "Machine Policy Retrieval and Evaluation Cycle" Action; wait ~2 minutes for retrieval to complete.
At a client, perform a "Machine Policy Retrieval and Evaluation Cycle" Action; wait ~2 minutes for evaluation of the just-received new policies.
At a client, perform a "Hardware Inventory" action.
Monitor the client log file windir\system32\ccm\logs\inventoryagent.log; you will be looking for something like "Select Name, SystemVariable, UserName, VariableValue from win32_environment" to be requested. If you do not see that line; either your editing of the SMS_DEF.MOF was rejected and the one containing "FALSE" for that class was replaced from backup automatically, or you need to do another "Machine Policy Retrieval and Evaluation Cycle"; and another "Hardware Inventory" action.

Once clients begin reporting on this new class, you will be able to create queries, collection queries, or reports on Environment variables.

Internet Explorer, Right-click 'Convert to Adobe PDF' Fails - Adobe Acrobat 8.1.1

skissinger — Fri, 22 Feb 2008 23:39:00 GMT

Product: Adobe Acrobat Pro 8.1.1

Symptoms: In Internet Explorer, with Adobe PDF integration enabled, right-click on a web page and choosing "Convert to Adobe PDF" does nothing.

Cause: Actually, not 100% sure on what the cause really is, but in testing of machines exhibiting this problem, it seemed to be centered around "Adobe PDF Content Menu Helper", which is an ActiveX control with AcroIEFavClient.dll. On some machines, the option was missing completely, and would not appear until the fix was done. On others, the option was there; but the fix below had to be done in order for the ActiveX control to be successfully registered.

Fixing: I tried various combinations, repairing Adobe, reboots in between, etc. These steps, in this specific order, fixed the problem in the shortest amount of time.

Close all open applications
Launch Add or Remove Programs, Adobe Acrobat 8.1.1 Professional, Change, Next, Modify. Under the choices presented, select +Create Adobe PDF, + Acrobat PDFMaker. For the feature "Microsoft Internet Explorer", modify the selection from "This will be installed on local hard drive." to "This feature will not be available". Next, Update. Click Finish when done.
Right-click on the computer desktop, properties. Settings tab. Change "Color Quality" from "Highest (32 bit)" to "Medium (16 bit)". Click OK. Confirm you can still see the display by clicking Yes at the prompt.
Add or Remove Programs, Adobe Acrobat 8.1.1 Professional, Change, Next, Modify. Under the choices presented, select +Create Adobe PDF, + Acrobat PDFMaker. For the feature "Microsoft Internet Explorer", modify the selection from "This feature will not be available." To "This will be installed on local hard drive." Next, Update. Click Finish when done.
Launch Internet Explorer and confirm you can right-click "Convert to Adobe PDF".
If it does not work at first (it’s about 50/50 success while I was testing this fix), go to Tools, Internet Options, Programs Tab, Manage Addons… Highlight "Adobe PDF Content Menu Helper". At the bottom, "Disable" this addon; confirm, OK, OK. Exit Internet Explorer. Go back into IE, the same location, and "Enable" this addon; Ok. Ok. Test again (should work now).
Optional: Now that it’s working, you can go back and change Color Quality back to ‘Highest (32 bit)’. In my testing, that did work; but I noticed online for others which had to use the 16-bit to fix the issue; if they went back to 32-bit, after some undeterminite time the right-click Convert to Adobe PDF stopped working, and they had to run through the fix again. I suspect if this control has to be re-registered, when you are running at 32-bit Color Quality the re-registration fails. You may want to ask the person if they notice any different in color / video from 32bit to 16bit. You may decide to leave the setting at 16bit to avoid possible future problems.

Ok, now for the minor rant… I’m by no stretch of the imagination a programmer, so perhaps some activex / IE plugin programmer out there can tell me… why would my Color Quality set at 32bit prevent a plugin from registering? I’m sure there’s a sound, valid technical reason—but I just don’t get it.

By the way.. yes, I know Adobe Acrobat 8.1.2 update was released a few weeks ago. I haven’t tested it to see if it fixes this specific issue yet.

Finding computers with 'AutoAdminLogon' configured

skissinger — Fri, 22 Feb 2008 11:31:00 GMT

Below is a mof edit and a suggested report to assist in finding computers which are configured to login automatically. By design, your imaging process may leverage AutoAdminLogon. In that case, AutoLogonCount will have a value--I would guess generally 2 or 3 would be your highest count reported. If AutoLogonCount is in the hundreds or thousands or AutoLogonCount is blank that may point you to a security risk in your environment.

//`'`*._.*`'`*-
// Reporting Class - for ConfigMgr, put this section in sms_def.mof
//`'`*._.*`'`*-

#pragma namespace("\\\\.\\root\\cimv2\\SMS")

[SMS_Report(TRUE), SMS_Group_Name("AutoAdminLogon"),SMS_Class_ID("SMSExpert|AutoAdminLogon|1.0")]
class AutoAdminLogon : SMS_Class_Template
{
[SMS_Report(TRUE),key] string KeyName;
[SMS_Report(TRUE)] string DefaultDomainName;
[SMS_Report(TRUE)] string DefaultUserName;
[SMS_Report(TRUE)] string DefaultPassword;
[SMS_Report(TRUE)] string AutoAdminLogon;
[SMS_Report(TRUE)] uint32 AutoLogonCount;
};

//`'`*._.*`'`*-
// Data Class - for ConfigMgr, put this section in configuration.mof
//`'`*._.*`'`*-

#pragma namespace("\\\\.\\root\\cimv2")
[DYNPROPS]
class AutoAdminLogon
{
[key] string Keyname="";
       string DefaultDomainName;
       string DefaultUserName;
       string DefaultPassword;
       string AutoAdminLogon;
       uint32 AutoLogonCount;
};

[DYNPROPS]
instance of AutoAdminLogon
{
KeyName = "AutoAdminLogon";
[PropertyContext("local|HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon|DefaultDomainName"),
Dynamic,Provider("RegPropProv")] DefaultDomainName;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon|DefaultUserName"),
Dynamic,Provider("RegPropProv")] DefaultUserName;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon|DefaultPassword"),
Dynamic,Provider("RegPropProv")] DefaultPassword;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon|AutoAdminLogon"),
Dynamic,Provider("RegPropProv")] AutoAdminLogon;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon|AutoLogonCount"),
Dynamic,Provider("RegPropProv")] AutoLogonCount;
};

A report to get you started:

select sys.name0, aal.AutoAdminLogon0 [Auto Logon Enabled], aal.AutoLogonCount0 [Number of Auto Logons Remaining (BDD/MD)], aal.DefaultDomainName0 [Domain Name], aal.DefaultPassword0 [Default Password], aal.DefaultUserName0 [Default UserName]
from v_gs_AutoAdminLogon0 aal join v_r_system sys on sys.resourceid=aal.resourceid
where aal.AutoAdminLogon0 = 1

Outlook Cached Mode via Hardware Inventory

skissinger — Tue, 12 Feb 2008 18:33:00 GMT

We're in the midst of a project to get all users into Outlook Cached mode. We're using two methods to confirm this process, one is to look for a specific Group Policy being applied successfully (http://www.myitforum.com/articles/8/view.asp?id=11254) and checking the value of HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\UserNameHere\13dbb0c8aa05101a9bb000aa002fc45a\00036601, which, according to http://www.howto-outlook.com/howto/cachedmoderegkey.htm, contains information about cached or not cached.

Attached are 2 files, one is a vbscript you would run on a recurring basis, only when a user is logged in, with user rights, to read the contents of that registry key for the user and transfer the information to the HKLM part of the registry which SMS Hardware Inventory can pick up. The other file is the mof edit you would add to sms_def.mof and/or mini.mof/configuration.mof (depending upon your version of SMS/ConfigMgr and whether or not you use a mini)

A couple of caveats to be aware of. In the howto-outlook.com article, they mention that the enabled value is 84 01 00 00. That is the HEX value of the registry key. SMS reports on the Decimal value of the registry key, so in Resource Explorer you will see 132,1,0,0 If you happen to come across some great article explaining all of the possible values for this key, and what they mean, please remember to change hex to dec values (Run Calculator, view Scientific, if you've never done hex to dec conversions before).

Caveat #2: Although in my environment the majority of computers reporting back show either 132,1,0,0 (Cached mode on) or 4,0,0,0 (not cached), there are a total of 19 different values reported back. Read the howto-outlook.com article for the reasons why.

Other notes: the script pulls back 4 pieces of information: The value of the registry key, the name of the default Outlook Profile from which that value was taken, the currently logged in username, and the time the script ran to gather that information.

PS: If you DO happen to know what all of the values of that key mean, please share!

Configuring SystemCenterTools.com's Enhanced User Discovery 1.1

skissinger — Sat, 09 Feb 2008 02:43:00 GMT

Last summer, I had to rebuild our central primary site after hardware failure. At the time, I took detailed notes of how I setup http://www.systemcentertools.com 's EUD, or Enhanced User Discovery 1.1, for SMS 2003. I recently came across my notes and thought "This would be a good blog entry."

After installation on your primary site server, you need to edit 1 file to configure. There is another file to edit if you wish to pull in more AD Attributes than those in the default settings file.

File #1:   \program files\Enhanced AD user Discovery v1.1\Enhanced AD User Discovery.exe.config
Line 6: change value="SMSDomain" to be your (shortname) domain. I assume it might be something like   MYCOMPANY (not mycompany.com)
Line 11: change value="" to be your fqn domain name. Like   mycompany.com
Line 15: change value="SMSSERVER" to be the name of your smsserver.
Line 19: change value="RC2" to be the site code of your smsserver.
Line 22: change value="c:\sms\inboxes\ddm.box\" to be the correct location for that folder on that sms server. For me, we install sms to the E: drive, so I had to change it.
Line 27: (optional) change value="c:\enhancedaduserdisc.log" to   <yourdriveletter>:\sms\logs\enhaduserdisc.log.

(I called that optional simply because I like all my sms logs in the sms\logs folder, not on the root of c:

File #2 \program files\Enhanced AD user Discovery v1.1\aduserattribs.xml. This next file you can leave alone forever; but if you want to pull in more ad attributes, you'd add them to aduserattribs.xml. For me, I added 2 additional attributes. I wouldn't mess with that file until you've confirmed success for the defaults attributes.

<ADAttrib>
<ADAttribName>telephoneNumber</ADAttribName>
<DDRPropertyName>Telephone</DDRPropertyName>
<DDRPropertyLength>128</DDRPropertyLength>
</ADAttrib>
<ADAttrib>
<ADAttribName>ipPhone</ADAttribName>
<DDRPropertyName>IPPhone</DDRPropertyName>
<DDRPropertyLength>64</DDRPropertyLength>
</ADAttrib>

The reason I added them was because at my company we have a VOIP phone system, and I wanted that attribute available for SMS reports for the helpdesk and techs.

How to test:

Double-click the executable (assuming your logged-in account has the credentials to read user objects in AD)
Open up the log file (for me, that was e:\sms\logs\enhaduserdisc.log) using trace32.exe
You'll either see if fail almost immediately if a configuration is incorrect; or, you'll see it start enumerating all of your user accounts out of AD. For me, it only takes ~3 minutes to finish gathering data. Then it has to send the DDRs into the ddm.box folder, and your SMS server has to pull in the information. Depending upon your server, and the number of user objects in AD for you, I can't estimate how long that might take; but give it at least 5-10 minutes. Then in the SMS console, the All Users collection, pick a user (like yourself) that will most likely have entries for email, department, title, description, first name, last name (which are the default attributes pulled in); right-click that user, and scroll through the list of things--you should hopefully see the new attributes (with data) listed!

How to automate so it pulls in any new or changed user information:
I set up a scheduled task on my primary site server to run that executable at 3 a.m. daily, using a service account. On whatever schedule you normally use when checking on overall SMS Health, check the enhaduserdisc.log to confirm it is working as expected.

Notes: at this time, EUD 1.1 is not needed if you are running ConfigMgr 07; you can pull in additional Active Directory user attributes by modifying the existing Discovery Method for "Active Directory User Discovery", the Active Directory Attributes tab.

SMS/BDD Engineer Needed - Milwaukee, WI

skissinger — Sun, 20 Jan 2008 02:06:00 GMT

Posted in the job board

Our imaging expert got lured away by Dell. And who could blame him? It was an excellent opportunity and career move for him. So we're looking for a new team member.