Merry Christmas and a Happy New Year

From Henk's blog (and sponsors) we wish you all Merry Christmas and a Happy New Year!! Hope you liked all information last year about Microsoft System Center and Windows Intune.

Jalasoft

Veeam

Expect more to come in 2014 again!
#HappyHolidays

Multiple anti-malware policies visible in Endpoint Protection 2012 R2

In SCCM 2012 with Service Pack 1 (SP1) with Endpoint Protection (SCEP) it was needed to look in registry when multiple anti-malware policies were active. More about that here: Prepare ConfigMgr client for Sysprep or Master Image.
It mentions: The policy name in SCEP will be named "Antimalware policy" by default. All SCEP policies applied can be found in registry: "HKLM\Software\Microsoft\CCM\EPAgent\LastAppliedPolicy"

In SCCM 2012 Release 2 (R2) this isn't needed anymore. This because multiple anti-malware policies are displayed in the SCEP client now. Much better this way isn't it!?

Anti-malware platform update for Endpoint Protection clients

As you can see a new Endpoint Protection (SCEP) update is available for System Center (SCCM) 2012 R2 installations. This is the third update available for SCCM 2012 R2 till now. In this blogpost an overview of all R2 hotfixes.
 
1) An update is available for the "Operating System Deployment" feature of System Center 2012 R2 Configuration Manager
2) Per-computer variables for imported computers are not read in System Center 2012 R2 Configuration Manager
3) November 2013 anti-malware platform update for Endpoint Protection clients

This article describes an anti-malware platform update package for the following clients:
- SCCM 2012 R2 Endpoint Protection clients
- SCCM 2012 (SP1) Endpoint Protection clients
- Forefront Endpoint Protection (FEP) 2010 clients

These packages update Endpoint Protection client services, drivers, and UI components.

Microsoft regularly releases anti-malware platform updates to guarantee consistency in protection, performance, robustness, and usability in a malware landscape that is constantly changing. This update package is dated November 2013.

You can download the Hotfix here: Microsoft Support

SCCM 2012 SP1 Offline Servicing - Failed to install update

Last week I did a deployment on a Windows 7 (with offline updates integrated), created in ConfigMgr 2012 SP1. Because of new installation, I want to deploy the image with ConfigMgr 2012 R2. During OS deployment (installing system components) the following error message was seen in mini-setup: Windows could not configure one or more system components. To install Windows, restart the computer and then restart the installation.

After reboot another error message was displayed: The computer restarted unexpectedly or encountered an unexpected error. Windows installation cannot proceed. To install Windows, click "OK" to restart the computer, and then restart the installation.

Lucky me I found the issue reading the following post:

SCCM 2012 SP1 Offline Servicing - Failed to install update
http://social.technet.microsoft.com/Forums/en-US/9c34add1-5261-4dcf-b3f6-7c26ef4fcd28/sccm-2012-sp1-offline-servicing-failed-to-install-update?forum=configmanagerosd
It mentions: I have seen this, best I can tell, whenever offline servicing fails, you end up with a corrupted image and get the errors above.  Only solution I found is, use the bak WIM file that the offline servicing process to rollback.  Then you can retry offline servicing until it finally works without errors.  Then your WIM should work again.

After creating a new image (copy of install.wim from installation media) and importing updates by offline servicing again, everything went fine. Still strange that offline servicing can (sometimes) break your deployment image! Anyone?

Reminder: Xian NM Webinar

Sponsor post

Just a  reminder to let you know that there's a Xian NM Webinar on Friday December 13th at 10 AM GMT-4/9 AM EST. All participants are eligible to enter our draw and win a FREE Xian Network Manager Bundle that includes 5 standard Network Device licenses plus 100 NetFlow IP address licenses!

Topics to be covered:

• Architecture
• SNMP monitoring
• Discovering a device
• Applying rules and policy templates
• Netflow monitoring
• Adding a source
• Creating a filter
• Creating a rule
• OpsMgr
• Events
• Alerts
• Performance graphs
• Reports
• UI integration

Register Now!

Download Driver packages for Dell, HP and Lenovo systems

Good news! When you are using MDT and/or SCCM/ConfigMgr and want to create driver packages, you can download them for Dell, HP and Lenovo systems. That saves a lot of time, because to need to download every single driver available. Let's have a look at the different methods for companies.

Dell has a website available for Driver CAB files for Enterprise Client OS Deployment. This can be used for WinPE (5.0 also!), XPS systems, Venue systems, Latitude systems, Optiplex systems and Precision systems. There are also combo packs available. They can be found here: http://en.community.dell.com/techcenter/enterprise-client/w/wiki/2065.dell-driver-cab-files-for-enterprise-client-os-deployment.aspx
Just use "Dell Client Integration Pack" to import Driver CAB files in a easy way: http://en.community.dell.com/techcenter/os-applications/w/wiki/2565.dell-client-integration-pack.aspx

HP takes the next step and provides ready-made driver packages for MDT and SCCM for the business models of notebooks, desktops and workstations. The packages can be obtained via SoftPaq Download Manager (SDM) or from the HP support website. It appears they are primarily for the current generation of products. To get the download manager, navigate to the HP manageability website: www.hp.com/go/easydeploy or directly to www.hp.com/go/sdm

Lenovo has a website available for "Microsoft SCCM and MDT Package Index". This can be used for ThinkCentre systems, ThinkStation systems and ThinkPad systems. Packages provide the device drivers in .inf form for, in order to allow you to deploy Windows images with SCCM by importing the device drivers. These driver packs are also supported with MDT. They can be found here: http://support.lenovo.com/en_US/downloads/detail.page?DocID=HT074984

Really great to see that known vendors has support for MDT and/or SCCM/ConfigMgr now!

Update: HP Client Integration Kit for ConfigMgr 2012 R2

Manage Windows (RT) 8.1 devices in Windows Intune

Yesterday I want to enroll Windows Intune (integrated in System Center 2012 R2 Configuration Manager) on a Surface 2 Pro (Windows 8.1 Pro) and Surface 2 RT (Windows RT 8.1). Unfortunately you must have certificates for both devices available for doing an enrollment to deploy any custom apps. This must be done in ConfigMgr (because this is my Mobile Device Management Authority) from now on.

For Windows Phone there is a Support Tool for Windows Intune Trial Management of Window Phone 8 available. More about that one in this blogpost. Let's have a look in ConfigMgr now. Within Software Library "Windows RT Sideloading Keys" can be created. These are not available for trial purposes as far as I know?

This is needed for both Windows RT, Windows RT 8.1 and Windows 8.1 which are not domain-joined. When devices are domain-joined (when possible and/or supported) a certificate is not needed. Within Windows Intune Subscription properties an Code-signing certificate (CER or CRT file) is needed to get the job done.

Why Microsoft has choosen for this, while Apple and Google has better (and cheaper) ways? To do this you must supply an Enterprise Agreement (EA) Sideloading key, which can be obtained from your Microsoft Volume Licensing Service Center provider. Pity I can't manage my new Surfaces now! Anyone?

Update 15-1-2014: When looking for a workaround on Windows RT sideloading keys have a look at this blogpost.

Exclude software updates from Automatic Deployment Rule

Hi, today I get a request if it's possible to exclude a specific software update from an Automatic Deployment Rule. This because functionality was broken between Skydrive Pro and our SharePoint 2010 server. The following update must be excluded which is malefactor on this. Let's do a query on Software Updates first. With Criteria you can search (for example) on Title. My search is on KB2837652. You can see that the update is downloaded and deployed.

Software Update is active


You can choose to use "Edit Membership" and remove the update, but because of Automatic Deployment Rule, the software update will be deployed again after next run. A better way is to change the Automatic Deployment Rule query. Let's have a look on that one. Normally I use values on Product, Required and Superseded here. 

Automatic Deployment Rule query

This time I added a new value, named Title. When you add a random name with a "-" before it, it will be excluded from software updates. When you don't use the "-" it will be added to the already chosen updates query. When you start "Run now" on the Automatic Deployment Rule the above configuration will be active.

Software Update is non-active

Great to see that the chosen update is non-active now! I added a title on "Update for Microsoft SkyDrive Pro" and "KB2837652". This time no need to use "Edit Membership" anymore. The update will be ignored from now on! Happy customer :)

The "Black Friday" of software is coming to you

Sponsor post

 

 

This upcoming Monday, Jalasoft will hold an incredible sale of 50% off on both of our products, Xian NM 2012 and Xian Wings!! If you’re looking for the top network monitoring tool out there, to save you time and effort  and provide you with a solution that allows you to monitor even the smallest details of your network, look no further! For one day only, you can get your hands on our acclaimed software, Xian NM 2012, for half of its original price. Don’t think any longer, jump on board the Xian NM train today!!  If it feels right, it probably is!! And there’s no way you can feel bad about this deal.

Get a quote by contacting us at sales@jalasoft.com or by calling us at +1 888 402 6717. Place the order on Monday and you will get a 50% OFF on any of our products.

Windows 7 USB/DVD Download Tool (WUDT) is unable to copy files

Yesterday I want to create a Boot media with Windows 7 USB/DVD Download Tool. This Boot media came from ConfigMgr 2012 R2, which is based on Windows PE 5 (Windows 8.1). Everything seems fine, but creating the Boot media was getting stuck on 98%. Created the Boot media a few times again, but without any luck. Finally found a nice blogpost with more information about this issue.

This post explains why the Windows 7 USB/DVD Download Tool (WUDT) is unable to copy the install files to the USB drive in some cases. It mentions: If you have problems Windows 7 USB/DVD Download Tool you can try the free alternative Rufus. Rufus is a small utility that helps format and create bootable USB flash drives, such as USB keys/pendrives, memory sticks, etc.

After using Rufus everything went fine, and USB Boot media was finally working. Hope it helps!

Ultimate New Year’s Resolution from Veeam

Sponsor post

5 Winners to Get a New Gear with Veeam!
Exclusively for the virtualization community, Veeam raffles great prizes that will improve IT Pros daily working experience!

Join the raffle and be fully equipped for 2014!

Register now to get one of the following prizes:
-Tablet of your choice: Android, iPad or Surface
-Class of your choice: Microsoft Training or VMware Education Services course
-Event of your choice: TechEd or VMworld in your geography (pass, no travel)
-Home lab with HP and Netgear products: one mega server, ReadyNAS Pro, SSDs and amazing WiFi router
-Software kit: MSDN subscription, Veeam NFR licenses and VMware vSphere

Make sure to register before Dec. 24 to enter raffle!

Register to Win!

New ConfigMgr 2012 R2 Policy Hotfix available

Yesterday a new ConfigMgr 2012 R2 Policy Hotfix is released. This because Per-computer task sequence variables that are defined for imported computers are filtered out of client policies. This prevents the variables from being read during task sequence execution. This problem does not affect per-computer variables that are defined for existing clients.

This update applies only to Primary sites.
Important Per-computer task sequence variables have to be recreated if they were created after System Center 2012 R2 Configuration Manager was installed but before this update is applied.

You can download the Hotfix here: Microsoft Support

Support Tool for Windows Intune Trial Management of Window Phone 8

When using Windows Intune for demo usage and want to test Windows Phone 8 a certificate is needed. This can be resolved by using "Support Tool for Windows Intune Trial Management of Window Phone 8". This tool facilitates Microsoft System Center 2012 Configuration Manager admins and Windows Intune admins to try out Windows Phone 8 software distribution scenarios during the Trial period.

The downloaded support tool contains a script that populates a sample Application Enrollment Token in the Microsoft System Center 2012 Configuration Manager environment, a sample Windows Phone 8 Company Portal app, and two sample applications that can be used for WP8 software distribution scenarios.

Operation is finished successfully

Download link and Install instructions: Microsoft Download Center

How to Set Mobile Device Management Authority

In Windows Intune you can choose to set the Mobile Device Management Authority for Mobile Device Management. The Mobile Device Management Authority can be set to Windows Intune OR System Center Configuration Manager (SCCM/ConfigMgr). Consider carefully whether you want to manage mobile devices by using Windows Intune only or SCCM with Windows Intune Integration. After you set the mobile device management authority to either of these options, this cannot be changed.

In Windows Intune you can set the Mobile Device Management Authority from within the Admin Console. More information about this choice can be found on Microsoft TechNet.

1.Open the Windows Intune administrator console.
2.In the workspace shortcuts pane, click the Administration icon.
3.In the navigation pane, click Mobile Device Management Setup.
4.In the Tasks list on the Policy Overview page, click Set Mobile Device Management Authority.
5.The Set Mobile Device Management Authority dialog box appears, and it prompts you to choose whether to use Windows Intune to manage the mobile devices in your account. Do one of the following: Click Yes to use Windows Intune to manage mobile devices for your account. If you set Windows Intune as the management authority, you must manage mobile devices by using the Windows Intune administrator console.
Important: If you plan to use SCCM to manage mobile devices for your account, do not set the mobile device management authority to Windows Intune. To set the mobile device management authority to SCCM, you must use your organizational account to create a Windows Intune subscription from within the SCCM console, and select the option to allow Configuration Manager to manage the subscription.

In SCCM you can set the Mobile Device Management Authority from within the Administration pane. More information about this can be found on Microsoft TechNet.

1.In the Configuration Manager console, click Administration.
2.For System Center 2012 Configuration Manager SP1: In the Administration workspace, expand Hierarchy Configuration, and click Windows Intune Subscriptions.
For System Center 2012 R2 Configuration Manager: In the Administration workspace, expand Cloud Services, and click Windows Intune Subscriptions.
3.For System Center 2012 Configuration Manager SP1: On the Home tab, in the Create group, click Create Windows Intune Subscription.
System Center 2012 R2 Configuration Manager: On the Home tab, click Add Windows Intune Subscription.
4.On the Introduction page of the Create Windows Intune Subscription Wizard, review the text and click Next.
5.On the Subscription page, click Sign in and sign in by using your Windows Intune organizational account. Select the Allow the Configuration Manager console to manage this subscription check box. When you select this setting, you will only be able to manage mobile devices by using the Configuration Manager console. To continue with your subscription, you must select this option.
Important: Once you select Configuration Manager as your management authority, you cannot change the management authority to Windows Intune in the future.

In case of bad decision it's possible to contact Microsoft Support on this to reset the Mobile Device Management Authority for your account. In that case all managed computers and/or mobile devices must be removed from Windows Intune. After the reset it's possible to set the Mobile Device Management Authority again.

Reminder: Xian NM Webinar

Sponsor post

Just a  reminder to let you know that there's a Xian NM Webinar on Friday November 22nd at 10 AM EST. More information about this webinar wil be posted soon!

Join now for a change to win a Xian NM bundle.

Register Now!

Visitors to henkhoogendoorn.blogspot.com

Today I'm using ClustrMaps for a year now! This because with Blogger it isn't possible how many visitors you get. Great to see where visitors are coming from. Let's have a look at statistics now.


Visitors last year

Visitors from all over the globe

Top 10 Visitors by Country

Hope to welcome more visitors next year!

SCEP updates pushed out to clients through SCCM 2012

Last week I had an issue on my ConfigMgr server with local WSUS installation. After fixing WSUS in a earlier blogpost, Definition Updates didn't install on my systems. This because of a Group Policy (GPO) which was set by a colleague ;) The following was seen in the WUAHandler log: Group policy settings were overwritten by a higher authority (Domain Controller). The GPO just had the server name and port (SCCM01:8530) and SCCM had the FQDN and port (SCCM01.Contoso.local:8530).

Sample from WindowsUpdate.log

 

Sample from WUAHandler.log

 
Lucky me I found the issue reading the following post:

EP updates pushed out to clients through SCCM 2012
http://social.technet.microsoft.com/Forums/forefront/en-US/a9bb6c1c-1473-4fe7-bf1d-a689792c8100/ep-updates-pushed-out-to-clients-through-sccm-2012?forum=FCSNext
It mentions: It looks like there was a conflict on how the WSUS server was defined in Group Policy versus what SCCM had (GP just had the server name and port and SCCM had the FQDN and port). Once I removed the GP setting all together and updated the policy etc then it seemed like things started to happen. In the UpdateDeployment.log I was seeing these errors:
Job error (0x87d00692) received for assignment ({76d342f7-e312-4c6d-9c60-29be10cc5212}) action
The setup recommends the short name for your GPO but I wasn't seeing deployments reach any of the endpoints. Changing to the FQDN of the server in the GPO fixed the issue and I'm now seeing percentage completed stats and deployments working.

What you have to do is use a GPO with only "Specify intranet Microsoft update service location" (FQDN) & "Allow Automatic Updates immediate installation". When using FQDN for update management above error messages are gone. This time it will work fine again!

WSUS Post Deployment Configuration Fails on Windows Server 2012

Last week I had an issue on my ConfigMgr server with local WSUS installation. The WSUS (Windows Update) service couldn't be started and Server Manager (in Windows Server 2012) RTM gives an error message also: The WSUS content directory is not accessible. In this case no (new) update management is possible anymore.


Sample from Event Viewer

Lucky me I found the issue reading the following posts:

WSUS Post Deployment Configuration Fails on Windows Server 2012
http://blogs.technet.com/b/reshard_sharps_blog/archive/2013/08/18/wsus-post-deployment-configuration-fails.aspx
It mentions: When using SQL for your database instance you must specify the name of your SQL server. One would assume if the database is local the wizard would find the instance without specifying the SQL server name. If you select Check Connection without specifying a server name it will return Successfully Connected to server. Despite this misleading result, it was not successful. The server name value it expects when running the Post Deployment step will be empty and will cause Post Deployment to fail.

WSUS install on Server 2012 Fails
http://social.technet.microsoft.com/Forums/windowsserver/en-US/91e45363-bbf7-414a-8932-779b1c170c3e/wsus-install-on-server-2012-fails?forum=winserverwsus
It mentions: I solved this issue by opening IIS Manager and deleting the old WSUS web site, then running the Complete WSUS Installation again.

What you have to do is uninstall WSUS, remove the IIS website manually, keep the WSUS database (it won't be removed after all) and reboot the server. After reboot install WSUS again, choose to check connection with the SQL server filled in, and start Post Deployment. This time it will work fine again!

New ConfigMgr 2012 R2 OSD Hotfix available

A few days ago a new ConfigMgr 2012 R2 OSD Hotfix is released. This because many customers couldn't PXE boot anymore. Have a look at these forums for more information about the issue:
Microsoft Technet, Windows Noob & MyITForum

This update resolves the following issues:
Issue 1
After you enable the PXE Service Point role on an instance of a specific distribution point, or you select the Deploy this boot image from the PXE-enabled distribution point property of a boot image, the Windows Deployment Service (WDS) stops running. Additionally, entries that resemble the following are logged in the Windows Application log:

Faulting application name: svchost.exe_WDSServer, version: 6.3.9600.16384, time stamp: 0x5215dfe3
Faulting module name: MSVCR100.dll, version: 10.0.40219.1, time stamp: 0x4d5f034a
Exception code: 0xc0000005
Fault offset: 0x000000000005f61a
Faulting process id: 0xae4
Faulting application start time: 0x01cec5d767184634
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Program Files\Microsoft Configuration Manager\bin\x64\MSVCR100.dll

Note This problem affects only distribution points that are installed on site servers.

Issue 2
When operating system image files are downloaded to Configuration Manager 2012 R2 clients, you may find that the download takes longer than it did in previous versions of Configuration Manager 2012 clients. You may see this behavior when the target client is running Windows PE or a full Windows operating system.

You can download the Hotfix here: Microsoft Support

Today: Xian Wings 2.0 webinar

Sponsor post

Join Jalasoft this Friday November 8th at 10 am EST for an online demonstration of Xian Wings 2.0. This webinar will provide you with an overview of Xian Wings 2.0 capabilities, and give you the opportunity to ask as many questions as you like! As a plus all participants are eligible to enter our draw and win a FREE Xian Wings client license!

 

We will see the following topics:   

• Wings HD for iPad
•  Dashboards
•  Widgets
•  State details
•  Alert details
•  Performance graphs details
•  Remote PowerShell
•  Wings for smart phones
•  Summary screen
•  States view
•  Alerts view
•  Performance graphs view

 

Register Now!