New update rollup for ConfigMgr Current Branch (1602)

Recently (May 27, 2016) for ConfigMgr Current Branch (1602) is released, also known as KB3155482. It fixes multiple issues on both ConfigMgr and Microsoft Intune. It cannot be downloaded, but will be available in the ConfigMgr console instead.

Here's a list of issues that are fixed:
-Remote Control (1x)
-Site Systems (1x)
-Microsoft Intune and mobile device management (5x)

As you can see it fixes mostly Intune (MDM) parts. When not using Intune, just wait for build 1606 coming soon.

This hotfix is available for installation in the Updates and Servicing node of the ConfigMgr console. If the service connection point is in offline mode, you have to re-import the update so that it is listed in the ConfigMgr console.

For more information on the update have a look here:
Microsoft Support

Hopefully the ConfigMgr certificate issue is solved now too!

Using ConfigMgr 2012 R2 SP1 and Microsoft Intune in a Hybrid configuration

Within my daily job I'm doing Configuration Manager (ConfigMgr) and Endpoint Protection (SCEP) consultancy and training a lot. ConfigMgr is a great product for managing on-premises devices, like servers, desktops and notebooks. With Microsoft Intune, Mobile Device and Application Management on tablets and smartphones can be done. This is a standalone Software as a service (SAAS) solution which exists for multiple years now. When integrating both solutions, you have a Hybrid configuration in-place.

Benefit of using a Hybrid configuration is integration! You can manage both Windows, Mac and Mobile devices within a single management console. Just make sure to set the management authority (which can be set on Office 365, Intune or Configuration Manager) on the right one. When it's set on Configuration Manager no management has to be done in the SAAS console anymore. Just use collections, applications and policies which are in ConfigMgr by default, to manage mobile devices as well. On the different clients, a Intune Company Portal needs to be installed for management.

Last years Microsoft has done a good job to improve speed on client communication and policies. That way you can enroll a mobile device in a few minutes, publish policies and applications, and set an unenrollment (when needed) all within approx. 15/20 minutes. When forcing a Reset passcode (new passcode must be entered) or Remote lock (device is locked and passcode needs to be set again), it will be active in approx. 1/2 minutes. During unenrollment all configuration and apps are removed also. Reasons enough to stay enrolled.

With Windows 10 Mobile coming, the richest set on policies can be configured. When creating policies (configuration items), you will see the difference on Android, iOS and Windows (Phone) platforms. Hope that will be better and easier in the future. It's possible also to deploy applications (from the different app stores) and weblinks to mobile devices. You can choose to open them in a web browser or install them. During installation a shortcut is created in Apps, so no need to open the Intune Company Portal again.

Hope to have some real experience on Windows 10 (Mobile) soon. It looks like the choice is really easy now! Just use Windows 10, Azure Active Directory (AAD), Enterprise Mobility Suite (EMS/Intune) and ConfigMgr from now on. That way Microsoft can convince you on the new generation available, which is Mobile first, Cloud first. Windows as a service, ConfigMgr as a service (2016) and Software as a service! I'm very excited about this, hope you are too?!

The following can be found on the "In the cloud" blog:
While there have been many improvements to the MDM capabilities, not every management capability exists – yet. To solve for this, we have effectively built a “bridge” between the ConfigMgr agent and the MDM agent which enables the agents to co-exist and expose all the existing manageability that you know today – as well as the new functionality that is being exposed via MDM to be manageable from the ConfigMgr console. No one else (traditional PC management or EMM vendor) has done any work like this. This is another HUGE reason that ConfigMgr + EMS is your best solution for deploying and managing Windows 10.

Just great if you ask me :-)

How to reset your MDM authority in Microsoft Intune

When starting with Microsoft Intune, you must setup a MDM (Mobile Device Management) authority to continue. This MDM authority can be set on Microsoft Intune (using the SAAS solution), ConfigMgr (using the hybrid solution) or Office 365 (included with Office 365 commercial subscriptions). During a hybrid installation (which is ConfigMgr connected with Intune) the MDM authority was already set to Office 365. That way it isn't possible to connect it with ConfigMgr.

Unfortunately the only way to reset your MDM authority is to call Microsoft Intune support and wait 5 business days at maximum to get the job done. After that it can be configured for Intune or ConfigMgr again. Hope that Microsoft can simplify the process in the future, so that people can do it themselves. Very annoying to wait several days, when you know the action can be done within a few minutes.. 

When the reset has taken place (there may be no devices enrolled within Microsoft Intune), you can set the MDM authority again. Just make sure to choose the right one this time :-)

Note: Microsoft mentions that the reset is done in US only, so no luck for EMEA people who want to have a quick result.

Update: In the end it took almost 6 (!) days to reset the MDM authority. My project is delayed 2 months because of this.

Contact details:
Microsoft Intune support
Contact Assisted Phone Support for Microsoft Intune

Event 10102, Health Service Modules, PerfDataSource warnings

On a ConfigMgr server at customer location I did see a lot of Event 10102, Health Service Modules, PerfDataSource warnings. Every 75 minutes, there were a lot of warnings detected, and customer want me to resolve this. Let's have a look.

A warning was looking like this:
In PerfDataSource, could not resolve counter SMS Inbox, File Current Count, swmproc.box>usage. Module will not be unloaded.
One or more workflows were affected by this. 
Workflow name: Microsoft.SystemCenter2012.ConfigurationManager.Perf_Threshold_Site_server_SWM_inbox_backlog_monitor
Instance name: ConfigMgr Primary Site Server - <removed>
Instance ID: {ECB782E3-F42F-23D2-C609-65CC8B78BA48}
Management group: <removed>

Because this message was coming from Operations Manager, and the OpsMgr Action account was configured on local system, I thought it would be a good idea to have a look at local administrator permissions. Long story short, I added both ConfigMgr SYSTEM account and SQL service account to the ConfigMgr server local administrator permissions, and after reboot no warnings were there anymore. In the end it was a security issue after all. Hope it helps!

How to add devices to different OU’s during deployment

In ConfigMgr it's possible to use a WMI query for Hardware vendor, type or model or part of computername (for example). In my situation I want to use a single task sequence for both desktop and laptop/ notebook deployments. This because to select different OU's during deployment. Let's have a look how to do that.
 
Within MDT you can use a variable like IsLaptop equals “True” or IsDesktop equals “True”. Within ConfigMgr I never used these before (while they are supported as well). There is another method however, besides of using part of computername. In this case you can run a WMI query to detect the hardware type.

My preferred method is as follows:
SELECT * FROM Win32_ComputerSystem WHERE PCSystemType = 1
SELECT * FROM Win32_ComputerSystem WHERE PCSystemType = 2
Example: 1 is for desktops and 2 is for laptops/notebooks.

If you want to combine multiple types, then use an "If statement" to the task sequence step, and specify multiple WMI queries. When using a single task sequence for both desktops and laptops/notebooks, use "Apply Network Settings" twice, with both a different WMI query.

When looking for more hardware types, use the following table:

• 0 (0×0) Unspecified
• 1 (0×1) Desktop
• 2 (0×2) Mobile (Laptop/Notebook)
• 3 (0×3) Workstation
• 4 (0×4) Enterprise Server
• 5 (0×5) Small Office / Home Office Server
• 6 (0×6) Appliance PC
• 7 (0×7) Performance Server
• 8 (0×8) Maximum

 
Hope it helps!

More blogposts on this topic:
Chassis Types and query-based Collections (part 2)

WSUS Post Deployment Configuration Fails on Windows Server 2012

Last week I had an issue on my ConfigMgr server with local WSUS installation. The WSUS (Windows Update) service couldn't be started and Server Manager (in Windows Server 2012) RTM gives an error message also: The WSUS content directory is not accessible. In this case no (new) update management is possible anymore.


Sample from Event Viewer

Lucky me I found the issue reading the following posts:

WSUS Post Deployment Configuration Fails on Windows Server 2012
http://blogs.technet.com/b/reshard_sharps_blog/archive/2013/08/18/wsus-post-deployment-configuration-fails.aspx
It mentions: When using SQL for your database instance you must specify the name of your SQL server. One would assume if the database is local the wizard would find the instance without specifying the SQL server name. If you select Check Connection without specifying a server name it will return Successfully Connected to server. Despite this misleading result, it was not successful. The server name value it expects when running the Post Deployment step will be empty and will cause Post Deployment to fail.

WSUS install on Server 2012 Fails
http://social.technet.microsoft.com/Forums/windowsserver/en-US/91e45363-bbf7-414a-8932-779b1c170c3e/wsus-install-on-server-2012-fails?forum=winserverwsus
It mentions: I solved this issue by opening IIS Manager and deleting the old WSUS web site, then running the Complete WSUS Installation again.

What you have to do is uninstall WSUS, remove the IIS website manually, keep the WSUS database (it won't be removed after all) and reboot the server. After reboot install WSUS again, choose to check connection with the SQL server filled in, and start Post Deployment. This time it will work fine again!

Configure dynamic collections in ConfigMgr

After the success of my first blog "Creating dynamic collections in ConfigMgr" (most pageviews on this blog), I will write a follow-up on this item. It seems that many people are searching on this specific item, because there are no dymanic collections based on AD discovery data when installing ConfigMgr 2007. In this blog I will describe exactly what to do for having dynamic configuration. It must work this way!

First create new collections for all places there are systems in Active Directory OU's. When you have different OU's for desktops, laptops & specials for meaning, create collections for that systems also. It is also possible to bound user groups to it, which are useful for application deployment. I will write a new blog for App-V packages in ConfigMgr 2007 later on. On all of the collections you have the choice to configure systems or users/user groups.

  
I have created an "Virtual Machines" OU first. Now start a "Active Directory System Group Discovery". This can be found at Site Management > Site Server > Site Settings > Discovery Methods. This System Group Discovery must have the following settings: "Enable Active Directory System Group Discovery".

Choose the yellow star, and add the domain you are working with. In my case this is SystemCenter.com. First choose for the default AD settings: Local domain and Recursive will be default selected. It is also possible for selecting an specific OU, instead of complete discovery (see options below).

• Local domain: Browse for AD containers in the domain where the computer running the Configuration Manager 2007 console resides.
• Custom LDAP: Indicates that you want to browse for Active Directory containers. This option activates Browse.
• Recursive: Default. When selected, indicates that AD discovery searches child containers. Otherwise, child containers are not searched.
• Include groups: Not default. When selected, Active Directory discovery discovers objects within groups.

When choosing for Local domain (default option), the above screenshot will be displayed. Choose the Domainname for searching in all containers. The OU's with systems in it will be automatically recognized. (It is also possible for selecting an specific OU, instead of complete discovery).

On the tab "Polling Schedule" you can change the schedule option from 1 day to 1 hour or lower (best practice when using ConfigMgr 2007 R2). This because otherwise new Active Directory OU's will be synchronized once a day. With ConfigMgr 2007 R3 this is not needed anymore, so it doesn't have to be changed.

New in ConfigMgr 2007 R3 is "Enable delta discovery" which is default set on 5 minutes. This setting doesn't have to be changed, because this performs an intermediate discovery cycle adding only new resources to the ConfigMgr database. Choose also "Run full discovery as soon as possible" for recognizing Active Directory OU's immediately.

On the tab "Membership Rules" you can change the schedule option from 1 day to 1 hour or lower (best practice when using ConfigMgr 2007 R2). This because otherwise new systems will be synchronized to collections once a day. With ConfigMgr 2007 R3 this is not needed anymore, so it doesn't have to be changed.

New in ConfigMgr 2007 R3 is "Dynamically add new resources" which is default off. Choose to turn it on, because this allows you to more rapidly evaluate a collection membership by adding only newly discovered resources. Now open collection properties (in my case Virtual Machines), and click on the yellow (database) icon.

Give the query a name (in my case Virtual Machines) and choose for "Edit Query Statement". Let the option "Collection limiting" at default (Not collection limited), because when choosing "Limit to collection" not all the systems can be found.

When select OK a new windows will be opened. On the tab "Criteria" select the yellow star, and choose Select again (beneath "Simple value"). Choose here for the following options:

Fill in "System Resource" and "System OU Name" and select OK. In the next field choose Value (beneath "is equal to"). This will open a new window, with OU's recognized before (Active Directory System Group Discovery).

As you can see only 2 options are available. This because these are the only containers which contains systems. I choose "Virtual Machines" here, and select OK again. My Criterion properties has the following information now:

Choose OK multiple times now, and the configurating will be done. Now there is a new collection created, which is synchonizing from a Active Directory OU. When I choose Refresh, the systems in Active Directory will be automatically displayed in the "Virtual Machines" collection.

I hope you have enough information now for setting up a dynamic collection. When there are questions or other input, please add a comment to this blog, or contact me by e-mail.

Using Multicast functionality in ConfigMgr

By default ConfigMgr 2007 Operating System Deployment (OSD) is deploying in Unicast. Every deployment or software distribution will be bit by bit transferred to the device. With ConfigMgr 2007 R2, and specific configuration, Multicast is also possible. Then you can deploy maybe 50 or 100 devices at a time, without the data (bits) being transferred to every device for itself. It's good to know that you have a few possibilities in Multicast, and it's only working in WinPE mode. So what's the advantage of it, with Software distribution in the Task Sequences?

When you talk about Multicast in ConfigMgr R2, there are two types of it. There is a Autocast and Scheduled Multicast possibility. I will describe them both, and explain the differences between them.

Autocast: With Autocast the deployment will start on the first device. When you deploy another device (or more than one) the stream will also be transferred to the other device(s). When the first one is finished, the other device(s) must only pick the other bits for completion. The only thing you have to do for Autocast functionality, is enable Multicast. (screenshot)

Scheduled Multicast: With Scheduled Multicast the deployment will wait for a few minutes or number of clients. The deployment will then start when one of the two conditions are met. The idea behind this, that you have more time to prepare your devices. With this type of deployment the bitstream wil go once over the network, to all your machines that are ready! (screenshot)

For Multicast to get it working, there is a Distribution Point and the Transport server in Windows Deployment Services (WDS) needed. When both are installed and enabled on a Windows 2008 Server, the configuration in ConfigMgr 2007 will take place.

Distribution point: In the ConfigMgr Distribution Point properties you must enable the setting "Allow clients to transfer content from the distribution point using BITS, HTTP and HTTPS". Also on the Multicast tab you must enable the "Enable multicast" setting. Have also a look on the Transfer rate possibility. Ideally this must be set to 100 Mbps or 1 Gbps for a good transfer speed.

When you also want to make use of Scheduled Multicast, you must enable the setting "Enable scheduled multicast" and set the Session start delay (# minutes) and the Minimum session size (# clients). When one of two are met, the deployment will be started (one bitstream).

Image deployment: When you want a succesfull Multicast deployment, the default WIM image must also be Multicast enabled. Open the properties of the WIM image (example: Windows XP SP2), and enable the setting "Allow this package to be transferred via multicast". You can also see here that Multicast functionality is only possible with WinPE (so during the first part of deployment).

When you don't want any Unicast deployment, enable also the setting "Transfer this package only via multicast". Then you are sure that Multicast will be used! Because this will only works in WinPE, there isn't any need to enable this setting on your Software packages. Now there only must be set an advertisement to get it work.

Advertisement: In the advertisement enable the setting "Download content locally when needed by running task sequence". When this is set on: "Access content directly from a distribution point when needed by the running task sequence", Multicast deployment will not work.

Deployment: These are some pictures displayed during deployment. The first one is captured during deployment in Autocast; the second one is captured during Scheduled Multicast.

Because Multicast works only in WinPE mode, you have the choice to put your applications in the default WIM image. Not installing them, but only put the source in it. Then you are still flexible, and make use of full Multicast functionality! Otherwise a part of the installation will be in Multicast, and the other part (applications) will not.

In the Task Sequence don't add your packages with "Install Software", but choose for "Run Command Line". Then put in there the command which is normally placed in Programs - Command Line, for unattended installation. For get it working place the location (e.g. C:\Apps) before the command, and the application will be installed from the local source.

That's all about Multicast for now!

Creating dynamic collections in ConfigMgr

When designing a new ConfigMgr environment, there is not only a total design needed but also a plan for the collections. I let my decision mostly be based on what functionality is needed, and if Active Directory is leading or not. This because you can create collections on many different ways, and advertisements can only be set on collections. So when you advertise an operating system, application or software update it will be bound to a collection. For OS deployment you can create additional colllections, but what to do with the other ones? The most used way is bound the collections to Active Directory OU's. In that way Active Directory is leading, and it will synchronize objects to ConfigMgr collections. I will explain here what to do, and how to bind them to Active Directory.

After installation of ConfigMgr there are a lot of default collections, but they are not always handy and useful. You can move this default collections to a new one, so there not in sight all the time. Now it's better to create your own collections, so you can decide which devices to put in your collections. There is a query needed for bounding collections to OU's, but first you must create these collections. You can do this manually, or there is also a way for importing them from Active Directory. The tool needed for that is named "SCCM OU Collection creator". This tool can be download here:

http://www.sccm-tools.com/tools/standalone/sccm-ou.rar.

With this tool you can create many collections at once, and the good news is it will be automatically bound to Active Directory OU's. Because you want to move these collections afterwards to another location, there is another tool needed, The tool needed for that is named "CollTree for SCCM". This tool can be download here:

http://myitforum.com/cs2/blogs/bleary/attachment/68439.ashx.

This tool is even compatible with SMS2003 collections, and it will become very handy. Okay, now the collections are imported, moved, and there is an query on it. But how to set a manually query on the collections? The command for that is not that difficult. First create a new collection, and open the properties of it. On the tab “Membership rules” create a new SQL query, and choose System Resource & Edit Query Statement, then select the Criteria tab. Choose New Query and fill in the following properties: 

Choose OK after that. Now you must decide how fast collections will be synchronized. Default the collection will be synchronized within 1 day. Because it can be to slow to have the objects in Active Directory synchronized with the collections, you can shorten the schedule to 1 hours, or even 15 minutes. Better is it to choose for the new R3 update, because collections will synchronized must faster then before. I will post that new functionality later. This is all you have to do for having dynamic collections in ConfigMgr.

ConfigMgr 2007 R3 is here!

Sooner then expected, but even a long wait: ConfigMgr 2007 R3 is here! This will be probably the last release for ConfigMgr 2007, because the next release is now available in beta. Which improvements will R3 bring to us, and is it worth it for installing the update? The answer is Yes, because there are some cool things in this release. Below is a quick summary of what’s new with R3:
  

Centralized Power Management
Configuration Manager R3 lets IT organizations centrally manage the power settings of Windows 7, Vista and XP computers, helping reduce energy consumption and costs. You can plan and apply a power management policy for high and low PC usage periods, monitor user activity to avoid any productivity interruptions and correct non-compliance. Detailed reports of trends and settings help you make smart power management choices, and also validate Green IT projects with summaries of power, money and CO2 savings.

Mobile Device Management
Configuration Manager R3 includes licenses for the popular System Center Mobile Device Manager, so you can run comprehensive asset inventories, deploy software, manage settings and enforce password policies for Windows phones.

Enhanced Scalability and Performance
Configuration Manager R3 is more scalable than ever, increasing the number of supported clients to 300,000 per site. R3 is also more efficient in the way it communicates with Active Directory, helping you discover user or machine changes more quickly and allowing custom queries to define user, system or group attributes.

Finally, it is worth noting that, just like Configuration Manager R2, R3 will be the foundation for the upcoming Forefront Endpoint Protection 2010. By bringing endpoint security into overall endpoint management, you can reduce costs and inefficiencies, and also improve security and compliance.

Especially the Power Management integration, and communication with Active Directory (which will be must faster), are useful functionality. Also the right-click tools are not necessary anymore for putting clients in a collection. This because R3 has this functionality build-in now. Right-click on a collection you want to manage and there is a new option available, "Add Resource". It is also possible to right-click a resource like a computer and use “Manage Collection Membership” to add it to a collection. Really useful!