Microsoft Ignite day 3 and 4 (Session) recap

Day 3 and 4 I did multiple sessions on ConfigMgr, Intune and Windows 10, listening to great speakers like Johan Arwidmark and Mikael Nystrom and some more. Very nice to see new functionality in both servicepack and vNext version coming. There will be more possibilities on both Mobile Device and Windows 10 Management. There are some improvements in the ConfigMgr console also.
 
Let's have a look at some interesting features so far:
-ConfigMgr will be more easily updatable to support windows 10 updates
-Intune will also iteratively stay up-to-date to manage windows 10 features
-Ability to manage Windows 10 PC's with MDM-style management
-New ConfigMgr version is like a servicepack, in-place upgrade possible
-Improved task sequence logging logic (better OSD logging)
-Windows 10 ADK available when Windows 10 is RTM
-New MDT Upgrade task sequence in MDT 2013 Update 1 Preview
-New functionality to restart the task sequence (multiple times)
-New functionality called Deployment verification (cool)
-New ConfigMgr task sequence for Windows 10 upgrade

Tuesday there was an interesting session about New and Upcoming features in Microsoft Intune and ConfigMgr. Let's have a look at it:
 
Microsoft Intune Roadmap
-Ability to restrict access to Outlook app based on device enrollment and compliance
-Intune App SDK for iOS
-Intune app Wrapping tool for Android
-Support for MAM in Outlooks app
-Multi-identity
-Support of Apple Volume Purchase Program (VPP)
-Windows 10 support
-Mac OS X support

Hybrid features for ConfigMgr 2012 R2 SP1 integrated with Intune
-Restrict access to Exchange on-premises email only if the device is managed
-Managed Office mobile apps – Word, Excel, PowerPoint, OneDrive, OneNote
-App Wrapping Tool for existing iOS line-of-business apps
-Managed Browser for iOS and Android devices
-Device lockdown via supervised iOS devices and Assigned Access for Windows Phone 8.1
-Application install allow/deny list
-Support for custom policies for iOS devices
-Deployment of email profiles for Android devices using Samsung KNOX
-Passcode reset and remote device lock for iOS, Android, and Windows Phone devices
-Support for Apple Device Enrollment Program (DEP)
-Support for Samsung KNOX Standard
-Push free store apps to iOS devices
And many many more!

Hope you liked my recaps during this week. Will do an overall Microsoft Ignite post next week! Stay tuned for more :-)
 
More blogposts on Microsoft Ignite:
Microsoft Ignite general attendee registration is SOLD OUT!
My scheduled sessions and product focus on Microsoft Ignite
Microsoft Ignite day 1 (Keynote) recap
Microsoft Ignite day 2 (Breakout) recap

Cumulative Update 5 for ConfigMgr 2012 R2 released

Today Cumulative Update (CU) 5 for ConfigMgr 2012 R2 is released. It fixes 13 issues and 1 additional change is included. No need to install CU4 anymore when using this one.

Here's a list of issues that are fixed, there are quite a lot of them:
- Reporting (1 fix)
- Software distribution and application management (3 fixes)
- Site servers and site systems (5 fixes)
- Client (1 fix)
- Operating system deployment (3 fixes)

Additional changes that are included in this update:
- Endpoint Protection (anti-malware platform update)

Just install it in your environment when experiencing problems described in this article. When not affected by these problems, Microsoft recommends to wait for the next service pack that contains this update. The version that is displayed in the About System Center Configuration Manager dialog box is 5.0.7958.1604.

This update replaces Cumulative Update 4 for System Center 2012 Configuration Manager R2

For more information or download the update have a look here:
Microsoft Support

Note: Because ConfigMgr 2012 SP2 and 2012 R2 SP1 is released next week (may 14th) already, it's better to wait for the service pack then installing this one. Just saying ;) Why Microsoft is releasing another CU so soon before the SP is not clear to me. Do you?
Johan Arwidmark mentioned on twitter: Wow, don't deploy CU5 for SCCM 2012 R2, those updates are included in SP2 which is releasing next week, and SP's are more tested than CU's.

More information about the service pack:
Microsoft Ignite day 1 (Keynote) recap
Microsoft Ignite day 2 (Breakout) recap

Microsoft Ignite day 2 (Session) recap

Day 2 I did a few sessions on Windows 10, listening to great speakers like Michael Niehaus and Mark Minasi. Besides of that there is much to do on networking, expo hall, tech labs, blogging and all things else. There is a big difference with Microsoft Management Summit (MMS) however, because less focus on ConfigMgr. There is not even a booth on ConfigMgr available. It's all about the cloud I guess.

Starting early again today I heard a few interesting features, like:
-Windows 10 will be fully Azure Active Directory (AAD) aware
-MDT 2013 Update 1 Preview is needed for Windows 10 deployment
-Business Store: merged stores of Windows, Phone and Xbox together
-Business Store does licensing tracking for licensed apps
-Windows 10: no more flatten-and-reimage, it's upgrade and refresh
-Migrate to IE11 on Windows 7 before upgrade to Windows 10
-The Windows footprint is reduced, saves multiple GB's on systems
-Insiders will get new versions and updates, even after RTM

Yesterday there was an interesting session about New and Upcoming features in Microsoft Intune and ConfigMgr. Let's have a look at it:

Overview: Windows 10 Management with ConfigMgr and Intune
-ConfigMgr Technical Preview released on may 4th
-ConfigMgr Generally Available on Q4 CY2015
-ConfigMgr 2012 SP2 and R2 SP1 release on may 14th
-Microsoft Intune service update on may 4th (app compatibility and management of new Windows 10 features via custom policies with incremental updates to deliver full support)
 
Improvements in ConfigMgr 2012 SP2 and 2012 R2 SP1:
-Faster virtual app (App-V) publishing at first logon for non-persistent VDI environments
-Increased hierarchy and primary standalone site scale
-Improved scale and performance for pull distribution points (DP)
-Hybrid parity features for ConfigMgr integrated with Microsoft Intune
-Improved data transfer reliability for slow and latent networks
-Full compatibility with existing features for Windows 10
-Native support for SQL Server 2014
And much, much more...

What’s new in the ConfigMgr Technical Preview:
-Full compatibility with existing features for Windows 10
-Support for Windows in-place upgrade
-First iteration of new hybrid option to manage Windows 10 devices via MDM with on-premises infrastructure
-Client deployment upgrade status monitoring added in admin console
-Support for running ConfigMgr in Azure Virtual Machines
And much, much more...
 
My next post will be about new features in Microsoft Intune. Expect more blogposts about Microsoft Ignite soon!

More blogposts on Microsoft Ignite:
Microsoft Ignite general attendee registration is SOLD OUT!
My scheduled sessions and product focus on Microsoft Ignite
Microsoft Ignite day 1 (Keynote) recap

Microsoft Ignite day 1 (Keynote) recap

Day 1 was a really busy day, starting on 8:00 AM already being on time for the keynote. With around 23.000 attendees it was full house! With speakers like Satya Nadella, Joe Belfiore, Gurdeep Singh Pall and Brad Anderson it was an impressive line-up. Sadly enough Wi-Fi connection was failing again (same experience as other keynotes before), so between 8:00 and 10:00 AM it was hard to have a connection on any device. Between 10:00 and 12:00 it went better, but still very slow. Pity if you like to share information like me :-)

Let's have a look at the announcements shared so far.
-Windows Update for Business
-Windows Server and System Center 2016
-SQL Server 2016
-Office 2016 Technical Preview available
-ConfigMgr vNext Technical Preview available
-ConfigMgr 2012 SP2 and R2 SP1 next week available
-Azure Stack (formely known as Azure Pack)
-Operations Management Suite (OMS)
-Microsoft Advanced Threat Analytics
-Intune support for Windows 10

Satya Nadella speaking during the keynote!

Windows 10 Build 10105 and 10107 was shown with a few new features and updates on Continuum, Biometric logon, Extensions for Edge browser and Encrypted files. Furthermore programs can be switched between multiple desktops now. Cortana is even more advanced at every build also. Great to see that Windows 10 is almost ready, as a new generation of Windows: Windows as a service.

Since today ConfigMgr and SCEP vNext Technical Preview is available. In this preview, you will get an early glimpse of the functionality that Microsoft is planning to release in Q4 of this calendar year, bringing with it full support for client deployment, upgrade, and management of Windows 10. The service packs for ConfigMgr 2012 and 2012 R2 will be available next week already! These will deliver full compatibility with existing features for Windows 10 deployment and management as well as several other features.

A second preview of Windows Server 2016 is available now too! Microsoft Intune is updated with support for Windows 10. Too much to mention in one blogpost as you can guess :-) My next post will be about new features in ConfigMgr 2016 and Microsoft Intune. Expect more blogposts about Microsoft Ignite soon!

Information and Download links:
-Exploring the Ignite Keynote Demos
-Announcing support for Windows 10 management with System Center Configuration Manager
-Microsoft Brings the Next Generation of Hybrid Cloud - Azure to Your Datacenter
-Introducing Microsoft Operations Management Suite
-Announcing the Microsoft Azure Stack
-Download ConfigMgr vNext Technical Preview
-Download Windows Server Technical Preview 2
-Microsoft Ignite keynote on Channel 9
 
More blogposts on Microsoft Ignite:
Microsoft Ignite general attendee registration is SOLD OUT!
My scheduled sessions and product focus on Microsoft Ignite

My findings after a large ConfigMgr deployment with Site servers worldwide

Last month I did a large ConfigMgr deployment. Last years I did dozens of implementations, but this one was special. This because beside The Primary Site server installation, ten (10) remote Site servers must be installed as well. I did this before also, but only twice on global scale. This time remote Site servers were placed in almost all continents, which is very cool if you ask me :-)

When having locations worldwide (with around 3.000 systems to manage), you must think about low bandwidth and/or high latency issues. Therefore your design must fit, so synchronization works, and OS deployment can be done in almost all continents worldwide. After a few weeks implementation all went fine. In this blogpost I will mention my findings so far. Hope they will be useful.

 

Special tasks provided during implementation:
-Application Catalog (doesn't work out-of-the-box always)
-Asset Intelligence - Licensing (easy to configure, nice to have)
-Asset Intelligence - Software (empty by default, but useful when configured)
-Compliance Settings - Configuration Items and Baselines (empty by default, but useful when configured)
-Monitoring Content transfer (different locations)
-Pull Distribution points (very useful if you ask me)
-Software Metering (doesn't work out-of-the-box always)

Special collections created for overview:
-Departments (all departments)
-Locations (all locations)
-Operating Systems (all operating systems)
-System Type (all system types)
Queries on Computer name, Model and System Type are used.
With all queries available and nested collections, you can create anything you want! :-)

Special tasks provided during OS deployment:
-BIOS Configuration Utility (HP)
-Define Active Directory OU Location
-Define and set Default Timezone
-Keep data & Format disk task sequence
-Set BIOS Password when not available (HP)
-Set Default Management Point (Affinity)

Very cool to see both Pull Distribution points and Management Point Affinity working. Furthermore Rate Limits on Remote Site servers are great to configure bandwidth usage. You can do so much in ConfigMgr, that almost everything is possible :-)

Have a look at "Most wanted features in ConfigMgr requested by customers" for functionality (still) missing in ConfigMgr.

Websites used during implementation:
-SCCM 2012 – Inventoried Software is empty?
-Monitor Virus guard definition level from SCCM 2012 compliance management
-Enable TPM for BitLocker usage during OS deployment on endpoints (part 2)
-How to add devices to different OU’s during deployment
-Chassis Types and query-based Collections (part 2)

My scheduled sessions and product focus on Microsoft Ignite

Within 2 weeks Microsoft Ignite is there! As for March 31st, the Microsoft Ignite general attendee registration is SOLD OUT! With around 20,000 attendees in attendance, it will be a great event full off Microsoft announcements and new technology. More about that can be found HERE. In this blogpost I mention my focus on products and sessions scheduled (for the moment).

When we look on products first, the following have my attention:
- Microsoft Azure (Update)
- Microsoft Deployment Toolkit (Update)
- Microsoft Intune (Enterprise Mobility)
- System Center 'vnext' (ConfigMgr and OpsMgr)
- Windows 10 (Technical Preview)

Well, that's not a lot you may think :-)
Most of sessions scheduled will be about Windows 10, which has my attention definitely:
- Azure AD and Windows 10 together
- Creating Kiosk Devices with Windows 10
- Deploy Windows 10 with ConfigMgr and MDT
- Manage Windows 10 with Intune and ConfigMgr
- Provisioning Windows 10 with New Tools
- Troubleshooting Windows 10
- Upgrading to Windows 10: In Depth
- What's New in Windows 10
- Windows 10 for Education
- Windows 10 for Enterprises
- Windows 10 for Mobile Devices
And so on..

Using the next version of Configuration Manager (ConfigMgr), Microsoft Intune or Deployment Toolkit, it will be even more great! It's not about Windows 10 only, it's about the new way of managing the operating system. With Azure AD, ConfigMgr 'vnext' and Intune there will be a lot of new possibilities for that. Sounds great isn't it?!

Expect a lot of tweets and blogposts around Microsoft Ignite from me, and lot's of other people love sharing knowledge.

Follow me on Twitter: @henkhoogendoorn

More blogposts on Microsoft Ignite:
Microsoft Ignite general attendee registration is SOLD OUT!

Current and upcoming features you’ll love in monitoring with Microsoft

Sponsor post

Join our exclusive webinar with MVPs Cameron Fuller and Bob Cornelissen (Jalasoft)

Operations Manager is continuously evolving! This includes management packs, new ways of looking at monitoring and gaining insight into monitored business services, cloud services, and more.

This webinar explores new developments in the Microsoft monitoring sphere, as well as developments in SCOM and Azure Operational Insights and how to benefit from these options: 

 

• Hear about changes in the current product to monitor your environment more effectively.
• Learn tips and tricks to be more effective as an Operations Manager administrator.
• See possibilities of Operational Insights and how the solutions from the Cloud can augment your monitoring.
• Explore the futures of SCOM and monitoring solutions from Microsoft.

Join us this Thursday, April 23rd, 2015 at 12:00 EDT / 11:00 CDT / 18:00 CEST.

Register now

The task sequence cannot be run because the program files cannot be located

After installing ConfigMgr with multiple remote Site servers (distribution points), we decided to configure half off them with a Fast connection, and half of them with a Slow connection. This can be configured on the boundary group, which contains one or multiple boundaries and is connected to all site servers. That way you are sure that content is downloaded from the local server and no or less WAN traffic takes place. But than it happens..

 

When starting deployment on Site servers deployment fails with the following error: Failed to run Task sequence. The task sequence cannot be run because the program files for ******** cannot be located on a distribution point. For more Information, contact your System Administrator or Helpdesk Operator.
In this case the package is the ConfigMgr client package.

We did the following to troubleshoot the issue:
-Check if boundary groups are connected to site servers and boundaries are set
-Redistribute and Validate the ConfigMgr client package on multiple site servers (multiple times)
-Check if VLAN communication is working on security, firewall and access control list

The following errors are seen in SMSTS.log
-Content location request for PR100003:3 failed. (Code 0x80040102)
-Failed to resolve PackageID=<?>
-Failed to resolve selected task sequence dependencies. Code(0x80040102)
-ThreadToResolveandExecuteTaskSequence failed. Code(0x80040102)

When looking on Microsoft TechNet forums, the error code has a relation with boundaries, boundary groups and/or the network access account. This was in our situation not the case. After deploying systems on site servers with a Fast connection, everything seems to be okay? When deploying systems on site servers with a Slow connection however not. When changing connection speed on boundary groups back from Slow to Fast the issue is gone. Above issue is because you have configured a boundary group on a Slow connection, not specific because the boundaries, boundary groups and/or network access account is configured wrong. https://social.technet.microsoft.com/Forums/en-US/949574ac-c947-4ff4-a817-263014246ee2/osd-failed-package-cannot-be-located-on-distribution-point
 

When looking on Microsoft TechNet Library, the following is mentioned: You can configure the network connection speed of each distribution point in a boundary group. Clients use this value when they connect to the distribution point. By default, the network connection speed is configured as Fast, but it can also be configured as Slow. The network connection speed and the deployment configuration determine whether a client can download content from a distribution point when the client is in an associated boundary group. https://technet.microsoft.com/en-us/library/gg712679.aspx
 
Strange thing is, that nothing is found on this specific configuration. I rest my case and leave it on Fast connection for now. For it seems you cannot start OS deployment on systems which are using a site server with Slow connection boundary group? That makes no sense however, because on software packages you can decide what to do on Slow or Fast connections. On a task sequence deployment this cannot be configured. Hope that someone can explain this behaviour, because otherwise Slow connection is kind of useless if you ask me.
https://social.technet.microsoft.com/Forums/en-US/2fbd2270-88e4-4fff-add1-5839b6b9b712/prevent-osd-over-wireless-and-vpn-networks

Another one bites the dust!

Enable TPM for BitLocker usage during OS deployment on endpoints (part 2)

Last year I did deployment with BitLocker usage on Dell systems. You can find more information about that here: Enable TPM for BitLocker usage during OS deployment on endpoints. This time I will do the same, but then on HP systems. As mentioned last time I didn't used it before. Let's have a look at possibilities on HP boxes. With this configuration there's no need for manually actions.

HP is offering a few websites for more information:
Client Management Solutions
HP BIOS Configuration Utility

When installing HP BIOS Configuration Utility (BCU) 4 files will be found. These are:
-BCUErr.cfg
-BIOS Configuration Utility User's Guide
-BIOSConfigUtility.exe (for x86 boot image)
-BIOSConfigUtility64.exe (for x64 boot image)
 
The HP BCU settings file is created with BiosConfigUtility.exe and /getconfig:<file> parameter. This file is used during deployment with /setconfig:<file> parameter. Have a look at BIOS Configuration Utility User Guide for more information on this.BCU also has the ability to establish, modify, and remove the BIOS setup password. Use the HP Password Encryption Utility (HPQPswd.exe) to create the password file needed to specify new or current password.

Use the following sample command to create a setup password on a system with no existing password:
BIOSConfigUtility.exe /nspwdfile:"new password.bin"
Use the following sample command to modify the BIOS setup password use:
BIOSConfigUtility.exe /nspwdfile:"new password.bin" /cspwdfile:"current password.bin"
Use the following sample command to remove the BIOS setup password use:
BIOSConfigUtility.exe /nspwdfile:"" /cspwdfile:"current password.bin"
NOTE: A password change command can be combined with BIOS configuration, in which case the password is modified before the configuration is applied.
BIOSConfigUtility.exe /set:"configuration.txt" /nspwdfile:"new password.bin"

The HPQPSDW utility is started with a GUI and an encrypted BIN file is created. With this file the system administrator password is set or changed. Download: HP System Software Manager

With this information both password can be set and BIOS settings can be changed. Just great if you ask me!

Other posts on BitLocker:
How to Enable BitLocker, Automatically save Keys to Active Directory
Enable TPM for BitLocker usage during OS deployment on endpoints
BitLocker fails in task sequence because of false condition

New Microsoft System Center and Windows versions coming!

This is a great year again because of new Microsoft System Center and Windows versions coming soon. Let's have a look at some big announcements so far! It's really a hugh list this time.

ConfigMgr 2012 R2 SP2 is first in line, which contains Cumulative Update (CU) 1-4 and even more hopefully. It will be released probably around Microsoft Ignite which is held in Chicago in May. There will be an update also to support Windows 10 deployment, upgrade and management with existing ConfigMgr features.
Source: WindowsITPro.com

Windows 10 is expected in September this year. A new Preview version is expected probably around Microsoft Build which is held in San Francisco in April/May. Windows 10 may be the best OS since Windows 7 finally! Windows 10: One product family, One platform, One store. Love it! Update: Windows 10 Launching This Summer in 190 Countries and 111 Languages already.
Source: Blogging Windows

Windows 10 ADK, which is needed to deploy Windows OS to new computers, will be released around Windows 10. A Preview version can be downloaded already: Download Center
Note: Before you even try, this version is NOT compatible with MDT 2013 (6.2.5019.0) or ConfigMgr 2012 R2.
Source: Deployment Research

Windows Server 'vnext' (2016) is expected in H1 next year. Because of strong focus on Cloud (Azure), expect more integration on that part. The Windows Server Technical Preview can be downloaded here: Windows Server Evaluations
At this technical preview milestone, many of the features and scenarios of Windows 10 and Windows Server are still in development and are not intended for broad production roll out.

The System Center Technical Preview delivers unified management across on-premises, service provider, and Microsoft Azure environments, thereby enabling the Microsoft Cloud OS. You need to be running Windows Server Technical Preview and Microsoft SQL Server 2014. Expect a final release somewhere in 2015.
Download: TechNet Evaluation Center
Source: The System Center Team Blog

The next version of ConfigMgr will deliver full support for client deployment, upgrade, and management of Windows 10 and associated updates. The next version of ConfigMgr, will ship in a timeframe that aligns with Windows. Microsoft has decided not to ship a ConfigMgr preview at this time, and will do so in H1 CY15.
Source: System Center Configuration Manager Team Blog
Source: Server & Cloud Blog

Office 365: Since last week built-in mobile device management (MDM) is available for Office 365 commercial plans. With MDM for Office 365, you can manage access to Office 365 data across a diverse range of phones and tablets, including iOS, Android and Windows Phone devices, without the need for Microsoft Intune.
Source: Feature Comparison with MDM for Office 365

Microsoft Intune: In addition, as Windows 10 delivers advanced mobile device management (MDM) to support evolving enterprise requirements, Intune will provide the leading mobile-first, cloud-first management capabilities for Windows 10.
Source: System Center Configuration Manager Team Blog

Office 2016 for Windows and Mac has been in private preview for several months, though anyone could request access if they were so inclined. Microsoft has expanded the program in March to it's commercial Office 365 customers, interested in testing the upcoming release. The reason today’s Skype technical preview is tied to Office 2016 is simple: Skype for Business will be part of the suite! Office 2016 will be launching in the second half of this year.
Download: Microsoft Connect
Source: Office Blogs & VentureBeat

Can't wait to install the bits later this year! Life is good :-)

More blogposts on this topic:
My personal experience with Windows 10 Technical Preview
Feature Comparison with MDM for Office 365

Microsoft Ignite general attendee registration is SOLD OUT!

As for March 31st, the Microsoft Ignite general attendee registration is SOLD OUT! With around 20,000 attendees in attendance, it will be a great event full off Microsoft announcements and new technology. Love it! When you're as lucky as me to have a Full Conference Pass, just visit the following websites for more information: 
http://ignite.microsoft.com/
ttp://www.choosechicago.com/microsoftignite/
http://channel9.msdn.com/Shows/Microsoft-Ignite-Countdown/Countdown-To-Microsoft-Ignite-CD9
https://johnacook.wordpress.com/2015/01/05/things-to-do-in-chicago-when-at-microsoft-ignite/
https://twitter.com/Begley_D/lists/Chicago
https://channel9.msdn.com/Forums/MicrosoftIgnite
https://myignite.microsoft.com/

Today with MyIgnite you can:
-Access Schedule Builder to search for session and labs that interest you and build your personalized conference schedule
-Join the Yammer Network and start discussions with speakers and your peers
-Edit your profile
-View sponsors and exhibitors

Busy now filling my schedule with lots of great sessions :-)
Just awesome to be part of this, and expect way more in the next coming months!

Update: when more links available I will update this blogpost.

More blogposts on Microsoft Ignite:
My scheduled sessions and product focus on Microsoft Ignite

Feature Comparison with Mobile Device Management for Office 365

Since this week built-in mobile device management (MDM) is available for Office 365 commercial plans. With MDM for Office 365, you can manage access to Office 365 data across a diverse range of phones and tablets, including iOS, Android and Windows Phone devices, without the need for Microsoft Intune. The built-in MDM features are included at no additional cost in all Office 365 commercial plans, including Business, Enterprise, EDU and Government plans.

 

Office 365’s MDM capabilities work to keep your data safe in three ways:
-Conditional Access: Setup security policies to ensure that Office 365 corporate email and documents can be accessed only on phones and tablets that are managed by your company and are compliant.
-Device management: Manage security policies such as PIN lock and jailbreak detection to help prevent unauthorized users from accessing corporate email and data on a device when it is lost or stolen.
-Selective wipe: Remove Office 365 company data from an device while leaving personal data in place.

When looking at the Feature Comparison, there are big differences seen between Exchange ActiveSync, MDM for Office 365, Intune Standalone and Intune + ConfigMgr (Hybrid). This Feature Comparison can help to decide which solution offers the functionality needed.

When looking for protection beyond what’s included in Office 365, you can subscribe to Microsoft Intune, part of the Microsoft Enterprise Mobility Suite, and receive additional device and application management capabilities for phones, tablets and PCs. With Microsoft Intune actions such as cut, copy, paste and save as to applications can be restricted as well, keep corporate information even more secure.

Nice to see that Office 365 has MDM capabilities from now on!

Source: Office Blogs

Most wanted features in ConfigMgr requested by customers

In my daily work I'm doing ConfigMgr implementations a lot. Multiple features missing in ConfigMgr 2007 were implemented in the 2012 release, which is still an awesome product (if you ask me)! Let's have a look at the most wanted features requested by customers. Don't know for sure what the 'vnext' release will bring, but still want to mention them. When having more, just leave a comment.

1) Hash value error during deployment: When updating a single package during deployment, which is part of a OSD task sequence, it fails because of hash value. When having a large enterprise company, it's hard to explain this! Maybe OSD and packaging are different teams then. Or people are working 24 hours around the globe in a single ConfigMgr Site. Just offer both old and new hash for a few hours and don't let the task sequence fail because of this! A colleague mentions: When this is the case, ConfigMgr isn't an enterprise product, and I think he is right on this point. (Must check it again)
2) Continue task sequence after error: It's crazy that when a task sequence fails (which happens a lot during testing), you cannot restart the task sequence from the point it fails. One mistake and you can start all over again, or you must enable "continue on error" on every step or group. Why not ask a question if you want to continue OSD after all? Makes life a lot easier during imaging.
3) User Environment Management (UEM): When customers want UEM functionality, they must use Group Policy, Preferences, MS UE-V, RES Workspace Manager, Imideo Flex Profiles or AppSense. Why not building more of Group Policy and Profile management in ConfigMgr, so you have best of both worlds? Hope that this part is available in the 'vnext' release, because Windows 10 may be controlled with ConfigMgr completely! Source: Windows 10 enterprise management with System Center Configuration Manager and Intune
4) Application control after deployment: When customers using ZENworks Configuration Manager (ZCM), it's hard to sell the ConfigMgr product. This is not because of imaging, which is a very strong selling feature! It's because of UEM and application control, which is part of ZCM by default. No way you can deploy shortcuts and decide on which time an application becomes available and on which time it's removed. This feature is requested in education a lot, where exams must be available on specific times only. Hope this will be way better in the 'vnext' release, not only on Windows 10, but on applications also.
5) Show collection membership for systems: One of great features of Powershell Right Click Tools, which let you you see in which collections a system or user resides. Should be default functionality in ConfigMgr if you ask me. Why not adding more management tools by default on systems and collections?
6) Black screen when using remote control: Hide the screen from the end user, when typing in sensitive information. Can be a valuable feature, because other remote tools offers this functionality also. Instead of a black screen, a message like "work in progress, please wait" is a nice-to-have also.
7) Change Distribution point (DP) when not available: When you have multiple DP's in the same IP-range, and content is available on one DP only, ConfigMgr is waiting for content and fails afterwards. Content is randomly selected on DP's, so you don't know at forehand which DP is selected per package. When adding content during deployment on the other DP, it will still continue (lucky enough). Better would be, when ConfigMgr doesn't see the needed content on a DP, it will use another one automatically.

Update 15-4-2015:
8) Enforce installation or upgrade during logon/logoff: Software installation can take place when a user is logged on or logged off, but sometimes you want to update a critical component. Best thing to do is to enforce this during logon or logoff, like Group Policy, without the possibility to use the component on the system. This isn't possible at the moment, so companies which are in 24/7 business, have a challenge that way.

Hope that some of features mentioned here are build-in a next release, or added at a later time. Time will tell ;)

Are you ready to learn more about Veeam MP features?

Sponsor post

Struggling with your virtual environment visibility in System Center? Are you concerned about optimizing your virtual resources?

Veeam Management Pack (MP) is designed to solve these challenges and more. We think you’ll be excited to see these short videos that show off some of the new capabilities in Veeam MP:

-Alerts and Host Dashboard (2:44)
-Capacity planning for hybrid cloud (2:33)
-Veeam Task Manager for Hyper-V (2:28)
-Compute Topology View (2:42)
-Change Analysis Reporting (3:04)
-Capacity planning (Oversized VM Report) (2:38)

View more videos on Veeam MP

Best regards,
Veeam Team

Installing SCEP 2012 - NIS updates during deployment

During deployment I'm using SCEP installation and update packages a lot. When using the script from Chris Nackers, new definitions can be downloaded automatically each day. Therefore a system is deployed with the latest SCEP update during deployment, and there's less security risk after deployment. Most of time SCEP installation, and antimalware/ antispyware (MPAM) updates goes fine, but Network Inspection System (NIS) updates goes wrong. Errors given are:
-Installation completed with exit code 0x80004005
-Installation failed with error (0x80004005)
-Install Software failed, hr=0x80004005. The operating system reported error 2147500037: Unspecified error

This because you're using the wrong version then. When looking on Microsoft Malware Protection Center, the following is mentioned:
1. Open your security software by double clicking on the icon in the system tray (you may need to click the arrow to see the icon) or, in Windows 8.1, search for Windows Defender:
2. Click the arrow next to Help and choose About:
3. Your software version number is displayed at the line labelled Antimalware Client Version

For version number 4.1.522.0 and above, you must download the Network Realtime Inspection definitions:
-For 32-bit versions of Windows, download 32-bit Network Realtime Inspection definitions
-For 64-bit versions of Windows, download 64-bit Network Realtime Inspection definitions
If you have a version number lower than 4.1.522.0, you must download the Network Inspection Service definitions:
-For 32-bit versions of Windows, download 32-bit Network Inspection Service definitions
-For 64-bit versions of Windows, download 64-bit Network Inspection Service definitions

So yes, there is a difference between Network Realtime Inspection (NRI) and Network Inspection Services (NIS) definitions.

Source: Malware Protection Center

More blogposts on this topic:
Install and update Endpoint Protection (SCEP) during a task sequence

An error occurred with the boot selection, verify media is present and retry

During re-deployment on a HP EliteBook Revolve 810 G3 tablet, the following error message was shown: "An error occurred with the boot selection, verify media is present and retry". Because of that no WinPE is loaded at all, and deployment is not possible. Lucky me the solution was not that hard. Let's have a look at the solution:

Boot your laptop and press F10.
Select [System Configuration]
Select [Boot Options]
Scroll down to [SecureBoot Configutation]
Disable BIOS Secure Boot
Change BIOS Boot Mode to UEFI Hybrid or Legacy Mode
Save and exit
Now boot and press [F12] and PXEboot works

Hope it helps!

Source: HP EliteBook Revolve 810 Tablet - PXE Boot Failure

Update: An ever better solution is as follows:
-Change BIOS to UEFI Native and SecureBoot
-Remove options 060, 066 and 067 from DHCP settings
-Add IP-Helper which is pointing to the WDS and DHCP server

Besides of that the following information:
Try to get rid of DHCP options and use IPhelpers instead. Also make sure that you are using a boot images that matches the architecture of the OS to be deployed. (Torsten)
UEFI is a new beast that has issues with DHCP scope options. UEFI is *very* different than traditional BIOS. (Jason)

Source: UEFI PXE BOOT ERROR

Microsoft Surface Pro 3 experience after 5 months

Since November last year I'm using a Microsoft Surface Pro 3 as primary device for my daily work. I wrote multiple blogposts about my experience in November and December. For over 5 months I'm very happy with my choice, never had a doubt I made the wrong choice here. But still there are some minors left. Let's have a look at my experience so far. Pro's and Con's are taken from my post before.

Pro's (changes in bold)
-Fast (with i7 CPU, i5 performance don't know)
-Quiet (on battery always, on power not all the time)
-Battery (approx. 8/9 hours with Office and Internet open)
-12" display (sharp, resolution, pen support)
-Pen (great in presentations)
-Weight (1,1 kg with keyboard)
-New generation device, high wow factor!
-Windows 10 upgrade coming (waiting for RTM to upgrade)
-Kickstand (can be placed in all positions)
-It's both a notebook and tablet

Con's (changes in blue)
-Fan blowing (on power only, not all the time)

As mentioned in the links below, this is being caused by the Windows Installer Module and the Windows Installer Module Worker, which start in the background at random times and cause the CPU to work at higher speeds. This causes the heat and the fans to kick into overdrive. When stopping these processes in Task Manager, my Surface is as quiet as on battery in seconds! Hope that this issue is fixed when moving to Windows 10 in a few months. Otherwise a hardware replacement may be needed to resolve this.
-Out of sleep (when in sleep mode, it will wake up. for it seems because of the keyboard?)
Sometimes my device will go out-of-sleep, which is annoying because all open programs will be gone afterwards. Strange thing that no hibernation is used for this? For it seems the device stays on, till battery power is reached a critical state. After that the device turns down. Lucky me this happens around rarely and not always. Hope this issue is fixed also when moving to Windows 10.
-One USB port only (far too little to connect multiple devices!)
Last week I ordered a Microsoft Arc Touch Mouse Surface Edition, because of this. The mouse works really fine, and benefit of it is a free USB port which I have now. Again no doubt I made the wrong choice here, and it looks great next to my Surface!
-Keyboard function keys (sometimes Fn is needed, sometimes not, which is confusing)
Well, you will get used to it ;)
-There is no insert key on the keyboard (mentioned by @scambler)
Didn't miss it myself actually. What I am missing on modern devices is the lack of pause key, which is really handy during PXE boot. Just have a look HERE for a workaround on the insert key.

More information about the fan blowing:
Fix found for Microsoft's Surface 3 overheating issues
Excessively loud fan, constant overheating during idle and light tasks
Tools To Simulate CPU / Memory / Disk Load (for testing purpose)

More blogposts on this topic:
Microsoft Surface Pro 3 first experience
Microsoft Surface Pro 3 second experience

ConfigMgr 2012 R2 OSD slow at Driver package and ConfigMgr client stage

Last month I did a ConfigMgr upgrade from SP1 to R2, with Cumulative Update 4 afterwards. At first sight everything seems to be okay. After a few weeks however, customer was mentioning OSD was very slow at Driver package and ConfigMgr client stage installation. Default deployment before the R2 upgrade was around 45 minutes, but after R2 upgrade around 135 minutes! Lucky me I found the following post on Microsoft TechNet HERE and HERE.

It mentions:
It appears that MS support was able to find a solution for my environment.
Immediately after enabling the "allow clients to connect anonymously" setting on each distribution point the time it took for the MDT Toolkit package to download went from 30 minutes to around 20 seconds.
The support tech was unable to explain why this setting was required following the R2 upgrade in our environment. He verified that in his lab environment he did NOT have this setting configured on the DP and he saw no issue downloading the MDT toolkit package.
As much as I would like to have a root cause for this issue I'm just happy that my OSD process isnt taking 3 hours now!

At customer mentioned this was the solution also. Immediately after enabling the "Allow clients to connect anonymously" setting on each distribution point configured, deployment was done in 45 minutes again. Strange enough I did a lot of R2 installations, and a lot of SP1 to R2 upgrades also, but never had this issue before. Still happy with this easy to implement solution. Thanks again!