When deploying modern devices like Microsoft Surface Pro or Lenovo Yoga Pro, no internal ethernet adapter is present. Therefore deployment is done on external ethernet adapter(s). Most of time many devices are ordered, but only a few ethernet adapters, because of high costs. Devices can connect to Wi-Fi networks afterwards, so no need to order a ethernet adapter too.
When deploying different devices with the same external ethernet adapter(s) over and over again, there may be an issue in the ConfigMgr database. This because devices are registered on MAC address by default. Because the MAC address is found in the external ethernet adapter instead in the device, you may know what's causing the problem. Let's have a look at the solution given..
Just import modern devices by SMBIOS GUID (UUID) instead of using MAC addresses. UUID is higher in rank than MAC addresses, and will overrule this. The UUID on devices can be found with the following WMI query (type in command prompt): wmic csproduct get UUID. When importing systems you can choose between MAC or UUID, so choose the 32 hex characters instead of the 12 hex one.
The following must be done too: Add the MAC Address of the external ethernet adapter to the list of MAC adresses that should be excluded from data discovery. This has to be done on the Primary Site Server. Open Regedit and browse to: HKLM\SOFTWARE\Microsoft\SMS\Components \SMS_DISCOVERY_DATA_MANAGER\ExcludeMACAddress.
It's possible to add multiple MAC addresses there too!
As you can see in the picture no MAC address is linked to the ConfigMgr client that way, and deployment went successful. Just deploy multiple modern devices, with the same external ethernet adapter, and without issues from now on!
When devices connecting to Wi-Fi networks afterwards, the MAC address will be registered as always.
Happy deploying :-)
Source: Microsoft Blogs
When deploying Windows 8.x with MDT or ConfigMgr, deployment may stop at the network selection screen. When press Connect in the selection screen, deployment will continue. Within this blogpost I show you how to skip network selection.
Within MDT:
The CustomSettings.ini (which can be found on Properties, Rules on the Deployment Share) needs to be changed as follows:
<OOBE>
<HideEULAPage>true</HideEULAPage>
<NetworkLocation>Work</NetworkLocation>
<ProtectYourPC>1</ProtectYourPC>
<HideLocalAccountScreen>true</HideLocalAccountScreen>
<HideOnlineAccountScreens>true</HideOnlineAccountScreens>
<HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
</OOBE>
Within ConfigMgr:
The unattend file (additional file which can be used in the Apply Operating System step) needs to be changed as follows:
<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend"> <settings pass="oobeSystem">
<component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<OOBE>
<HideEULAPage>true</HideEULAPage>
<HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
<NetworkLocation>Work</NetworkLocation>
<HideOnlineAccountScreens>true</HideOnlineAccountScreens>
<HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
<HideLocalAccountScreen>true</HideLocalAccountScreen>
</OOBE>
<RegisteredOwner>Microsoft</RegisteredOwner>
</component>
</settings>
<cpi:offlineImage cpi:source="" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
</unattend>
For x86 systems, change "amd64" in "x86" to get the job done.
Source locations:
Windows 8.1 deployment in MDT 2013
Windows 8.1 prompting for network (some lines missing)
When using the script from TechNet, the red lines are missing. Therefore an error message is displayed during mini-setup (about /unattend) and deployment stops on that point. Now way you can pass a deployment error during mini-setup, so just use the unattend file mentioned here. Hope it helps!
During deployment with MDT 2013, the following message is displayed: "Open File Security Warning Prompt". You have to click OK multiple times to get through the task sequence. Very annoying if you aks me! This because of the following problem: The issue is that when you download an .EXE, .ZIP, or .CAB Internet Explorer saves the Zone Identifier. This goes back to a feature that first appeared in Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1 and the feature works the same in later operating systems.
In my case this on ithe following files: gfxtray.exe, hkcmd.exe, igfxpers.exe and rtdcpl64.exe. Just rightclick the .EXE, click properties, and then click the “Unblock” option. After that no "Open File Security Warning Prompt" popup appear anymore!
Just nice to know if you ask me ;)
When doing OS deployment in ConfigMgr 2012 R2, which is one of main features, it seems nice to start monitoring on that. Especially when on a remote location and using Zero Touch installation (ZTI) to do the job. In older versions of ConfigMgr I used reporting for that. Within 2012 R2 it's possible to have a recent view in deployment monitoring. Let's have a look at functionality first.
When in the ConfigMgr console, go to the Monitoring tab. There you find Deployments. Within deployments you will find all packages, task sequences and update jobs which has an deployment on them. When looking at OS deployment monitoring, select the task sequence job running, and "View status". Have a look at "Summarization time", and click "Run summarization" when not recent. Click "Asset details" and "More details" to open a new window.
Within the new window, select status to see an overview of OS deployment steps. Unfortunately it's needed to sort them on Execution time and maximize the window every time when opening. Also the monitoring window is not dynamic so you need to "Run summarization" multiple times, and open the window again. Every time the window opens you need to sort on Execution time and maximize the window. At last it's not possible to start anything else in the Console as long as the monitoring window is active.
Let's recap. I really think OS deployment monitoring is great. Maybe Microsoft can create an dynamic monitoring window which saves the configuration? Customers are asking for this type of window also. For a first version it looks great but not complete yet. Hope this can be arranged in a new ConfigMgr update. Thanks!
Today we had the following error message on a Virtual Machine (VM) starting ConfigMgr Boot Media: Failed to get client identity 80004005. First I was thinking about Boundaries, because the VM was in a different subnet. After adding the needed IP-address ranges, the error message was still te same. Looking on MS TechNet the following thread was found.
The following solution is mentioned there: The problem was in the client computer, that has wrong Time and Date in BIOS. Simply adjust date and time to actual time, and the deployment works perfectly.
And indeed, on the VM the Time and Date in BIOS was not correct. After changing it to the right Time and Date everything went fine again. Hope it helps!
With ConfigMgr 2007 and 2012 there is OS Deployment possible with the use of Task Sequences. When advertise/deploy a Task Sequence used for OS Deployment, there is the choice for Lite Touch or Zero Touch Installation. In this blog I willl explain the difference between them, and what to do for having Lite Touch and/or Zero Touch functionality.
First I will explain the difference between them:
- Lite Touch Installation (LTI) is used when F12 must be pressed on the local device during PXE boot the device;
- Zero Touch Installation (ZTI) is used when nothing has to do be done on the local device for PXE boot functionality.
When using Windows Deployment Services (WDS) and/or Microsoft Deployment Toolkit (MDT), Lite Touch functionality is possible. With the use of System Center Configuration Manager (ConfigMgr), Zero Touch functionality will also become available. Both scenarios are handy, and will be used by customers. The choice between them, has something to do with Management, BIOS settings and (remote) locations.
Now let's have a look at the advertise/deploy settings:
When advertise/deploy an OS Deployment Task Sequence, choose "Make this task sequence available to boot media and PXE".
On the next screen create a Mandatory assignment when ZTI is needed. This will make the big difference between LTI and ZTI, a Mandatory assignment!
For having ZTI, also the PXE boot order must be set. When the Network adapter is not in first place, there is no ZTI possible. Also decide on which collection ZTI deployment will be advertised/deployed. This is not recommended on most collections, so create a new collection, specific for ZTI deployments!
On the ConfigMgr PXE service point, additional properties can be set. When "Require a password for computers to boot using PXE" is selected, no ZTI deployment is possible also. This will be become handy with LTI deployment, when pressing F12 for PXE boot, a password is needed to get a new OS image.
Also a big difference; with LTI a device can be installed many times again with a new image, without anything to do with the device in ConfigMgr collections. Only make sure that the device is placed in the right collection, where the advertisement is set.
With ZTI a device gets a PXE advertisement on the device in ConfigMgr collections, to prevent it for being installed over and over again. When a device must get a new OS image, just rightclick on the object, and choose "Clear Last PXE Advertisement. When this is done, the advertisement will become active automatically with next boot.
When will LTI or ZTI be the best solution? It depends..
When total control is needed, Password security, Choose between different OS images, Another boot order (harddisk or USB first), LTI will be the best solution there is. When remote OS deployment is needed, Auto-install on remote locations, Wake-On-LAN support, No interaction on the device, ZTI will be the best solution there is.
Do not hesitate when things are not clear enough, or additional questions are left. Just leave a comment then.
Because there are many challenges to control in ConfigMgr, I will post another blog about handy tips and tricks! This time I will order them on subject, so it's easy to find the right one! Everyday there are new challenges in ConfigMgr, but still it's a cool product. This because when it works, it can do a lot for you. And with new releases and updates it can even do more!
Here the new tips and tricks section:
Windows XP:
- With Windows XP your image is not that big (500Mb), but many Driver packages are needed (for every device a driver package). Put all Driver packages in the Task sequence, with a query on it. That way you can have a single image, single Task sequence, for many different devices.
- Because Windows XP don't recognize SATA disks by default, put SATA drivers in the Driver packages, and select the right model in the Task Sequence! That way it's not needed to change the BIOS setting from AHCI to ATA/IDE or something like that.
- Most of time I create a Sysprep package (extract files from deploy.cab), and put the sysprep.inf file in the Task sequence. That way you are flexible, and put desktops and laptops in their own OU's!
- For having Multicast functionality with maximum results, put the source files of applications in the image. That way you're still flexible with a clean image and sources (image gets bigger), and data goes only once over the network. This because Multicast only works in WinPE mode.
- Because there are so many Software updates after Windows XP SP3, update your image with as many updates that's possible. That way deployment goes faster, and less updates needs to be installed during or after deployment. For example: only install Office updates during Task sequence progress.
Windows 7:
- For creating Window 7 images, it's not necessary to add a product key in the Tasks sequence. Otherwise capturing the image will fail. The product key must be placed in the unattend.xml file, so installation can choose which Windows 7 version must be installed.
- With Windows 7 no large driver packages will be needed anymore. This because there is a large driver library build-in, and only specific (older) drivers must be manually added. Windows 7 is easy to install that way!
- Using sysprep, and creating a sysprep package is not necessary anymore. Just create a unattend.xml, and Windows will automatically run sysprep during deployment. Again: Windows 7 is easy to install that way!
- More tips and tricks for Windows 7 will follow later!
Software Updates:
The combination of ConfigMgr and Software Updates is not always a simple one. This because when it's not working, it's not always easy to find the solution. Here are some best practices for installing and configuring:
- When installing WSUS, choose always for a custom website, with ports 8530 and 8531. This way the ConfigMgr Management Point and Software Updates are not both configured on port 80 and 443 (best practice).
- When WSUS is installed, check permissions on the WSUS and WSUSContent folder. On both folders the Network Service account must have the right permissions. On the WSUS folder set Read permissions and on the WSUSContent folder set Full Control permissions for the Network Service account.
- When WSUS is installed with a custom website check security on the IIS website. This must be set to Anonymous authentication, with a "IUSR_<ConfigMgr Server>" account. This must be a Domain User account, with Local Admin rights on the ConfigMgr server.
- With MP Troubleshooter (ConfigMgr 2007 Toolkit) you can check if the IIS account has enough permissions for accessing both websites. It's always necessary for having enough (local) rights on the ConfigMgr server.
- Sometimes a Proxy server must be used for synchronizing updates. Try both configurations (on and off) with or without an User account. Sometimes there must also made a bypass on the Proxy server for getting it to work.
- At last, do a "Run Synchronization" on the Update Repository and follow the Software Updates in the wsyncmgr.log (easy to see with SMS Trace - ConfigMgr 2007 Toolkit). When synchronization is done, do it again till no updates are available anymore. Then create Search Folders.
- With Search folders it's easy to see which updates has come available for the last month (example) for a specific product. This updates can be drag-and-dropped on the Update Lists for creating overviews.
Driver Management:
- When importing drivers, only once a specific driver can be imported. With that knowledge it's not possible to create a specific folder for every hardware model. What i do most of time, is put a label (tag) on drivers, with the model number.
- When creating driver packages it's possible to have a mix of drivers (multiple hardware models). This because a specific driver can be imported once, and that driver must be available for multiple hardware models (for example).
- There is a hotfix available for importing drivers multiple times, for creating specific driver packages. This hotfix can be found at: http://support.microsoft.com/kb/2213600
- When using Dell systems, it's easy to using the "Dell Client Deployment Pack". Then the only thing you have to do is importing the CAB files, and Dell will create the driver packages for you!
- When using Dell systems, you can update or change BIOS settings with the "Dell Client Configuration Utility". Both downloads are plug-ins for ConfigMgr 2007, and will be visible in the console.
- On the Microsoft Update Catalogue, drivers can be found on specific names, or with Hardware ID's like the following:
"PCI\VEN_14E4&DEV_1677&SUBSYS_01AD1028". Just look in the details from drivers you want a specific driver for.
Service accounts:
- There are two (2) service accounts needed, when using ConfigMgr the right way. The Network Access (NA) account, and the Push Installation (PI) account. Both accounts can have Domain User rights, but the PI account must at least Local administrator on the device then.
- When setting up ConfigMgr with minimal (Domain User) security rights, more time is needed for setting up the server(s). This because sometimes the service accounts are used, and sometimes the Primary server computeraccount is used.
Access to remote share:
- The server which is your primary site server role is the one which needs to go to the source folder. So, the computer account in Active Directory for your primary site server is the account which needs to have at least Read rights to the remote network share, and read NTFS rights to the files/folders on that share.
Again, these are a few most common error messages and best practices during Task Sequence deployment in ConfigMgr. When having questions on a specific deployment issue, write a comment on this blog.
That's all for now, more tips and tricks later?!
For multiple years I am busy now with (client) deployment, delivering applications, configuring policies, and a lot of troubleshooting. This with many products, on both fysical and virtual systems. For example:
- System Center tools: Configuration Manager (SMS, SCCM), Operations Manager (MOM, SCOM), Essentials, Updates Publisher (SCUP), Server Updates Services (WSUS)
- Deployment tools: Ghost Server, Deployment Services (WDS), Deployment Toolkit (MDT) Configuration Manager (SMS, SCCM), Altiris Server, Wyse Device Manager (WDM)
- Knowledge of: Desktop Optimization Pack (MDOP), VMware View (VDI), RES PowerFuse, RES Wisdom, Group Policy Objects (GPO), Group Policy Preferences (GPP)
When doing (client) deployment in ConfigMgr 2007, you can have a lot of challenges. A few of this challenges I will describe in this blog. When having questions on a specific deployment issue, write a comment on this blog.
Here they are (most of them i've seen during the last few months):
- When deploying a device multiple times during a "capture and deploy" Task Sequence, and a abortpxe.com error message is displayed, delete the obsolete object in the specific collection, and add the new object again. Most of times there will be two objects with the same name. (where one will be obsolete)
- When deploying a device multiple times, and startover again within 15 minutes, there will be a error message displayed. This is default WDS (Windows Deployment Services) behaviour, and can be solved with restarting the WDS service.
- When creating a new Windows image from source files, put the auto-apply drivers or apply driver package step before the "Apply Operating System" step. Otherwise specific drivers (SATA disks for example) will not be functional when booting from disk.
- When distributing a Windows image (WIM file), put the auto-apply drivers or driver package step after the "Apply Operating System" step. Otherwise an error will follow, and Task Sequence fails.
- When using multiple driver packages for one single Windows image, put a WMI query on it. With the query SELECT * FROM Win32_ComputerSystem WHERE Model LIKE "%<MODEL>%" you can decide which driver package belongs to which system.
- When drivers or driver packages are not installed during deployment, add an extra line in sysprep.inf which contains "UpdateInstalledDrivers=Yes" to make it work again (Windows XP solution).
- When putting Software Updates in the Task Sequence, and the system is not yet domain member, add the next lines to the "Setup windows and ConfigMgr" step (SMSSLP=SERVERNAME.FQDN.COM SMSMP=SERVERNAME.FQDN.COM)
- When Software Updates are not installed during the Task Sequence, change the advertisement at Download Settings > Slow network boundary from "Do not install updates" to "Download software updates from distribution point and install".
- When build and capture Windows 7 in ConfigMgr, don't add a product key in the Task Sequence (Apply OS step). Otherwise it fails with error 8004005 and exit code 31. This because the product key and product will not match then!
- When access to a remote share (distribution point) is not working, then additional rights are needed. The server which is your Primary site server is the one which needs to go to the source folder. This account needs to have at least Read rights to the network share, and read NTFS rights to the files/folders on that share.
- When a "PXE-E32: TFTP open timeout" error message is displayed during PXE network boot, import the device manually in ConfigMgr, or activate "Unknown computer support" feature.
- When "Program Files cannot be located on a Distribution point" error message is displayed during loading the boot image, select "When no local distribution point is available, use a remote distribution point" in the advertisement.
Again, these are a few most common error messages and best practices during Task Sequence deployment in ConfigMgr. When having questions on a specific deployment issue, write a comment on this blog.
That's all for now, more tips and tricks later?!
