Prepare ConfigMgr client for Sysprep or Master Image

When building and deploying a master image with ConfigMgr for VDI usage, it's needed that a ConfigMgr client is installed. I did this multiple times in Citrix and VMware environments. Before the image is used for production usage, it's needed to prepare the ConfigMgr client first. Here are the steps that must be followed to do this.

1) Install the ConfigMgr client on the reference system during task sequence deployment or using local installation;
- CCMsetup.exe SMSSITECODE=<Site code>
2) Stop the SCCM client service;
- Start > Run - CMD.exe
- Type > Net stop "SMS Agent Host"
3) Remove the 2 SMS certificates in the local certificate store;
- Start > Run - MMC.exe
- Select Add/Remove Snap-In
- Select Certificates > Add
- Select Computer account > Next
- Select Local computer > Finish > OK
- Expand Certificates > SMS
- Delete both certificates
4) Delete the %SystemRoot%\SMSCFG.ini file;

Additional steps that can be taken to the Endpoint Protection client:
- For VDI, verify a Full Scan has been run on the Master Host Image, and that persistent cache has been populated;
- You can check the value in HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Scan\SFCState (if it’s 7 then it’s complete, on initial install it will be 0);
- To force the persistent cache to generate, RUN (from an elevated CMD):
- CD C:\Program Files\Microsoft Security Client
- Start > MpCmdRun.exe -buildSFC

Just for information:
- You can export the SCEP policy used and change DisableCatchupFullScan and DisableCatchupQuickScan from 0 to 1. After that the policy can be imported again. Not sure if this is needed all times, but it will surely help;
- The policy name in SCEP will be named "Antimalware policy" by default. All SCEP policies applied can be found in registry: "HKLM\Software\Microsoft\CCM\EPAgent\LastAppliedPolicy";
- During buildSFC a logfile (MpCmdRun.log) can be monitored in: "C:\Users\<username>\AppData\Local\Temp". It's possible that buildSFC must be started multiple times because of a timeout 2400 error. Just start it again till it shows "Service stopped. Exiting Idle TaskEnd";
- The cache file created can be found in: "C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\CacheManager". In my case the file was 1,820 KB in size;
- After buildSFC is finished, the SFCState can be found in registry again: "HKLM\Software\Microsoft\Microsoft Antimalware\Scan". The SFCState key should be changed from 0 to 7 then!

After that shutdown the reference image, create a snapshot (optional) and use it for your environment. This prevents multiple objects (with the same name) in ConfigMgr and duplicate hardware ID's (as we had in 2007 version). Hope it helps!

Source: Premier Field Engineering

Update 22-7-2013: Running the buildSFC command is something different then running a full scan on the master image. With a full scan the SCEP client can still start another full scan after using it in VDI. With the buildSFC command it will stop doing that.

Update 13-5-2014: During or after OS deployment the MpCmdRun.log can be found in: C:\Windows\Temp (because no one is logged in during deployment).

Continue TechNet or create an affordable alternative to MSDN subscriptions

Two weeks ago i posted a blog that Microsoft is going to stop the TechNet Subscription service. What I didn't posted yet is that a petition is available. If you think Microsoft has to continue TechNet or create an affordable alternative to MSDN subscriptions, You can sign this petition to let Microsoft know you're not happy with their decision. Are you happy with it?

 

The petition can be found here!

Reaching 5,000 signatures would be a HUGE for us! There has to be a way we can make it happen. Help to push us over the top. I'd offer to get a mo-hawk except I know we'll reach 5,000 and I'd have to do it!

Update 10-7-2013: I just signed the petition "Create an affordable alternative to MSDN subscriptions comparable to TechNet." on Change.org.

Update 24-7-2013: If you feel compelled to act, please write Microsoft. Start with Steve Ballmer. His email address should be steveb@microsoft.com. Outline in your own words reasons for keeping TechNet open and its importance to you. We need your help gathering email addresses. If you find any please share them. (message from Cody Skidmore, Change.org)

Update 25-7-2013: If you receive a reply from Microsoft please let us know. Email us at SaveTechNet@gmail.com.

Update 2-8-2013: We have a new email discussion list thanks to Rod Trent and Susan Bradley. I can't express enough gratitude for what they've done. The discussion list opens up communication so everyone can help guide the direction of our effort to save TechNet. You can subscribe to the list or its RSS feed by visiting http://bit.ly/1cbcJro.

Unknown SQL error in ConfigMgr after installing DotNet updates

Today I did onsite support at a customer because of ConfigMgr failure. After the weekend OS deployment wasn't working anymore. In the ConfigMgr console the following errors were seen:

SMS_STATE_SYSTEM
The State System message file processing could not process file '********.SMX' and moved it to the corrupt directory. Review the statesys.log file for further details.
Microsoft SQL Server reported SQL message 50000, severity 16: *** Unknown SQL Error!

STATESYS.LOG
*** *** Unknown SQL Error!
CMessageProcessor - Encountered a non-fatal SQL error while processing
CMessageProcessor - Non-fatal error while processing ********.SMX

SITESTAT.LOG
omGetServerRoleAvailabilityState could not read from the registry on <ConfigMgr server>; error = 6;
---->: Failed to get the Availability State on server <ConfigMgr server> fro role Distribution Point.

For it seems DotNet software updates were installed before the weekend. In total 14 (!) DotNet updates were installed after patch tuesday. After uninstalling KB2835393, KB2804576 and KB2840628 everything was working okay again.

Hope that Microsoft will fix this soon, because this is a mayor issue for customers who are using ConfigMgr!

Source: Edugeek > Thanks for sharing!

Update 16-7-2013: Looking on Microsoft support it seems that the issue is available only with KB2840628. No need to uninstall the other DotNet updates mentioned before. Microsoft is working on a update for the issue, so stay tuned for more later!

Update 19-7-2013: Microsoft has confirmed a few different issues with the latest .NET Framework 4 security update, KB 2840628, when applied to SQL Server 2012 (all versions) servers in a Configuration Manager environment. Microsoft is working on a revised update and will keep you posted. In the meantime, you can find temporary solutions for these issues in this blog post: Issues Reported with MS13-052 (KB2840628) and Configuration Manager

Client Push Installation fails in ConfigMgr 2012

Today I activated Client Push Installation in ConfigMgr 2012 in a existing environment. When looking in CMM.log there was no installation activity seen at all. Looking in the environment I found the following:

Looking at Client Push Installation settings, all was okay. The Client Push Installation account was configured (with Admin permissions), and Installation properties were set.

Ports needed for Client Push Installation were not set in the local Firewall settings published by Group Policy.

By default the following is needed:
-File and Printer Sharing
-Windows Management Instrumentation (WMI)

For Client Push Installation the following is needed also:
-RPC endpoint mapper – TCP 135
-RPC endpoint mapper – UDP 135
-Server Message Block (SMB) – TCP 445

"Use this boundary group for site assignment" was not set on the boundary group. This must be activated to make usage of Client Push Installation.

After making this changes everything went fine again! Looking in CCM.log installation activity was seen for all systems.

Premise vs. Premises in ConfigMgr 2012

Last month during the "Windows Management User Group (WMUG) NL day with Wally Mead", one minor detail was seen in the demo's. I guess nobody was seeing it (?), but I did because a colleague of my (Rob Beekmans, @robbeekmans) was mentioning it to me earlier. Here it comes! :-)

In ConfigMgr 2012 SP1 a Distribution Point type is called On-premise. This is wrong because the proper term is On-premises as in - on your premises (see below).

In ConfigMgr 2012 R2 they corrected this, because a Distribution Point type is now called On-premises. Good job Microsoft!

From Dictionary.com
Premise: a proposition supporting or helping to support a conclusion.
Premises: a tract of land including its buildings.

As I was saying before: one minor detail fixed! 

Version Build numbers from ConfigMgr 2012 and Current Branch

Last month (July 2013) I was at Windows Management User Group (WMUG) NL day with Wally Mead. Wally Mead has been with Microsoft for more than 21 years, and working with Systems Management Server since SMS 1.0 was in development. One of his question was about the Version Build number of ConfigMgr 2012 SP1, but nobody in the room knew the correct answer. Therefore this blogpost, so when Wally ask again we all know it! :)

- ConfigMgr 2012 RTM - 5.00.7711.0000
- ConfigMgr 2012 CU1 - 5.00.7711.0200
- ConfigMgr 2012 CU2 - 5.00.7711.0301
- ConfigMgr 2012 SP1 - 5.00.7804.1000
- ConfigMgr 2012 SP1 CU1 - 5.00.7804.1202
- ConfigMgr 2012 SP1 CU2 - 5.00.7804.1300
- ConfigMgr 2012 SP1 CU3 - 5.00.7804.1400
- ConfigMgr 2012 SP1 CU4 - 5.00.7804.1500
- ConfigMgr 2012 SP1 CU5 - 5.00.7804.1600
- ConfigMgr 2012 R2 - 5.00.7958.1000
- ConfigMgr 2012 R2 KB2905002 - 5.00.7958.1100
- ConfigMgr 2012 R2 CU1 - 5.00.7958.1203
- ConfigMgr 2012 R2 CU2 - 5.00.7958.1303
- ConfigMgr 2012 R2 CU3 - 5.00.7958.1401 
- ConfigMgr 2012 R2 CU4 - 5.00.7958.1501
- ConfigMgr 2012 R2 CU5 - 5.00.7958.1604
- ConfigMgr 2012 R2 SP1 - 5.00.8239.1000
- ConfigMgr 2012 R2 SP1 CU1 - 5.00.8239.1203
- ConfigMgr 2012 R2 SP1 CU2 - 5.00.8239.1301
- ConfigMgr 2012 R2 SP1 CU3 - 5.0.8239.1403

- ConfigMgr Current Branch 1511 - 5.0.8325.1000
- ConfigMgr Current Branch 1602 - 5.0.8355.1000

Source: Wikipedia

Updates on this blogpost:
Update 11-4-2014: Update on ConfigMgr 2012 R2 CU1
Update 2-7-2014: Update on ConfigMgr 2012 R2 CU2
Update 22-9-2014: Update on ConfigMgr 2012 R2 CU3
Update 23-4-2015: Update on ConfigMgr 2012 R2 CU4
Update 6-5-2015: Update on ConfigMgr 2012 R2 CU5
Update 15-5-2015: Update on ConfigMgr 2012 R2 SP1
Update 1-9-2015: Update on ConfigMgr 2012 R2 SP1 CU1
Update 10-11-2015: Update on ConfigMgr 2012 R2 SP1 CU2
Update 14-3-2016: Update on ConfigMgr 2012 R2 SP1 CU3 and Current Branch

Upgrade ConfigMgr 2012 SP1 to 2012 R2 Preview

Last week ConfigMgr 2012 R2 Preview became available for download. More about that can be found in the following blogposts: "Updates and New Features in ConfigMgr 2012 R2" and "TechEd 2013 Europe announcements".

Now it's time to update labs with the new bits, Windows Server 2012 R2 Preview and System Center ConfigMgr 2012 R2 Preview. My existing lab is running on Windows Server 2012, SQL Server 2012 SP1 and ConfigMgr 2012 SP1. This installation is described in the following blogpost: "Install ConfigMgr 2012 SP1 on Server 2012 and SQL 2012 SP1". Let's update my lab!

I did an update of Windows Server 2012 first. Within 5 minutes (on SSD) Windows Server 2012 is upgradet to Windows Server 2012 R2 Preview. Nothing special on that one.

After that it's needed to remove Windows Assessment and Deployment Kit (ADK) 8.0 and install ADK for Windows 8.1 Preview. Just select Deployment tools, Windows PE and USMT again.

Last start the System Center ConfigMgr upgrade after that. As described in "Updates and New Features in ConfigMgr 2012 R2". Upgrade to R2 is possible only from ConfigMgr SP1 with Windows ADK 8.1 which can be found HERE.

Just follow these steps for the upgrade:
- Start Splash.hta and choose Install
- Before you begin > Next
- Getting started > Upgrade this ConfigMgr site
- Product key > Install the evaluation edition of this product
- License terms > Accept these license terms
- Prerequisite licenses > Accept these license terms (3x)
- Prerequisite downloads > Download required files (23 items)
- Server language selection > English
- Client language selection > English
- Settings summary > Setup type: Upgrade
- Prerequisite check > In my case 2 items about built-in collections and SQL memory allocation
- Begin install > Elapsed time: 21 minutes
- Upgrade: Core setup has completed!

Very nice to have System Center ConfigMgr 2012 R2 installed now! Expect more blogposts to come about R2 later this month.

MCSE Desktop Infrastructure certification

Today I passed the Windows Server 2012 exam 70-417. This is an upgrade exam that is a composite of three standalone exams: 70-410, 70-411, and 70-412. Because I did a lot of exams last months, I place a complete overview in this blogpost. Here we go!
 
- 70-687 Configuring Windows 8 (70-689 wasn't available yet)
- 70-415 Implementing a Desktop Infrastructure
- 70-416 Implementing Desktop Application Environments
- 70-688 Managing and Maintaining Windows 8
- 70-417 Upgrading Your Skills to MCSA Windows Server 2012

With above exams I'm MCSA Windows 8, MCSA Windows Server 2012 and MCSE Desktop Infrastructure certified now! 

 

The MCSE Desktop Infrastructure certification validates your skills in desktop virtualization, remote desktop services and application virtualization. Show that you can deploy and manage desktops and devices that provide access from anywhere, while maintaining security and compliance.
 
More about new Microsoft exams can be found here: Overview of new Microsoft 2012 exams. Hope it helps!

Microsoft is going to stop the TechNet Subscription service

Yesterday I received the following message from Microsoft.

By developing trends in IT and changes in the dynamics of companies Microsoft has let it be to offer IT professionals Microsoft technologies and services to get to know, evaluate and implement evolve. In recent years, a shift from paid to free evaluations and information. Therefore, Microsoft has decided to stop the TechNet Subscriptions service and sale on August 31, 2013 to terminate.

Subscribers with active accounts continue to have access to the benefits of their program until the end of their current subscription period.

We are committed to customers in this transition phase to help and we continue to focus our attention on providing free access to IT professionals in a wide collection TechNet materials that IT professionals around the world need.

Better free offer for IT professionals including:

• TechNet Evaluation Center: Free evaluation software without disabilities, available for 30-180 days. With valuable evaluation resources and TechNet Virtual Labs, which you can evaluate without having to install locally. Anything software
• Microsoft Virtual Academy: Free site for online learning, with over 200 expert-led technical courses over 15 Microsoft technologies. Every week new courses at.
• TechNet Forums: Free online technical forums where IT professionals can ask questions and receive answers from members of the community quickly.

Note: MSDN Subscriptions provide a pay range that is available to anyone who needs access to evaluation software that goes beyond what the above free materials to offer.

We thank you for your understanding now we more focus on expanding our free offer and invest more in order to respond better to the needs of the community of IT professionals.

- The TechNet Subscription team

Additional Information:
More background information about Microsoft's decision to stop the TechNet Subscription service and the implications for existing subscribers can be found on the FAQ page on cessation of the TechNet Subscription service.

Note for Microsoft Certified Trainers (MCT)
My MCT agreement expires on March 31, 2014. Will I continue to have access to TechNet benefits though that date?
Subscribers with active accounts may continue to access their program benefits until their current subscription period concludes. For MCTs, this date is March 31, 2014.

Personal note: It's very pity that the TechNet Subscription stops. With the software it was ideal to test products and set up lab environments. Hope there will be an aternative offering in the future!

OS Deployment - Failed to get client identity 80004005

Today we had the following error message on a Virtual Machine (VM) starting ConfigMgr Boot Media: Failed to get client identity 80004005. First I was thinking about Boundaries, because the VM was in a different subnet. After adding the needed IP-address ranges, the error message was still te same. Looking on MS TechNet the following thread was found.

The following solution is mentioned there: The problem was in the client computer, that has wrong Time and Date in BIOS. Simply adjust date and time to actual time, and the deployment works perfectly.

And indeed, on the VM the Time and Date in BIOS was not correct. After changing it to the right Time and Date everything went fine again. Hope it helps!

Windows Update error 80070643 during installation

Last week I did a Task Sequence deployment on Windows 7 Enterprise with many (Microsoft) applications. During deployment the Task Sequence was failed because of Windows Update error 80070643. The specific step was during Internet Explorer 9.0 Language Pack installation found on Download Center.

Microsoft has the following to mention about this issue:
Windows Update error 80070643 can happen for several reasons. The most common cause is a problem with the .NET Framework installed on the computer. You might also encounter this error when installing updates for Microsoft Office 2003.

Lucky me the solution was found after a few local tries. The Internet Explorer 9.0 Language Pack can only be installed when the Windows 7 Language Pack is installed already. This is described HERE and needs to be installed locally. So lessons learned: Just install the Windows 7 Language Pack before the Internet Explorer 9.0 Language Pack.

Upgrade my Surface RT to Windows 8.1 Preview

As mentioned in my blogpost before, Windows 8.1 Preview is available for download. I choosed to upgrade my Surface RT already, because You'll be able to upgrade to the final edition of Windows RT 8.1 when it becomes available. If you're currently using Windows RT, you won't be able to uninstall Windows RT 8.1 Preview. Just enjoy the new Windows 8.1 experience!

I prefer to create a USB Recovery Drive first. This is very handy when your Windows RT device will not boot properly. It can be used to recover back or repair your Surface RT.

Let's get update my Surface RT. First you need to install a Windows Update which will - after reboot - make the necessary connection to MS Store. After selecting "Download" the update process is starting.

Just wait till the update process is finished. There will be a few necessary restarts during the update process. In my situation it all went fine. After a few hours (didn't watch at time) it was finished.

Just great to have Windows 8.1 Preview ready on my Surface RT now! What I didn't expected is a 3GB more free space available then before (from 12GB to 15GB free space). How's that possible?

First experience seems very good to me!

Update 16-7-2013: If Windows 8 users decide to simply wait until the final version of Windows 8.1 is released, and bypass installing the preview build, the good news is that they won't have to reinstall their apps. Some more good news: Windows 8.1 is expected to use less hard drive space compared to Windows 8, thanks to Microsoft making the move to remove older and temporary files, along with improving NTFS compression. Source: Neowin.net

Guide to create a USB Recovery Drive for Windows RT

When you want to install Windows 8.1 (Preview) on a Windows RT device, but not sure how to recover back just follow this guide. It can be used for repair also, so having a USB Recovery Drive is always a good option! In my case I use it for a Surface RT 32GB.

To create a USB Recovery Drive for Windows RT, simply use the step-by-step guide below:

1. Plug in a USB drive with at least 4GB of free space to your Windows RT device (Surface).
2. While in Windows Desktop, open Windows Explorer, click Desktop and select Control Panel.
3. From Control Panel, select "System and Security" and then "File History".
4. Next, in the bottom-left corner of the window, tap "Recovery", and then select "Create a Recovery Drive".

 

The recovery wizard will launch and guide through, then it will copy the recovery partition to the USB drive. After that it's possible to delete the recovery partition to clean up diskspace on your Windows RT device (Surface). I didn't do that, just for sure..

With the recovery partition you can repair Windows RT anytime! When Windows RT will not boot, use these steps for repair:

Warning: Be advised that following these instructions will reset Windows RT to factory settings, which means that all data and settings will be wiped out! Proceed with caution.

1. Shut down your Windows RT device (Surface) and insert the USB Recovery Drive.
2. While holding down the "Volume Down" switch, press and release the Windows RT Start button. After a few moments, the device will start and loads the recovery partition.

 

Follow the onscreen instructions to reset your Windows RT device.

The USB Recovery Drive is very handy when your Windows RT device will not boot properly. It can be used to recover back or repair your device (Surface). Hope it helps!

New Subscriber Downloads available

New downloads available for TechNet or MSDN subscribers. Let's download the bits and start installing evaluations!

- Windows Client 8.1 Preview
- System Center 2012 R2 Preview
- Windows Server 2012 R2 Preview
- Windows Server 2012 R2 Essentials Preview
- SQL Server 2014 CTP1

Source: http://technet.microsoft.com/en-US/

Windows 8.1 Preview is available for download

Good news, after many announcements yesterday at TechEd 2013 Europe, Microsoft announces Windows 8.1 Preview today during Build conference in San Francisco, CA.

You can go to preview.windows.com and download the update for your Windows 8 x86/x64 and RT devices.

You will be prompted to grab a standalone Windows Update install to prepare your system. When that update is installed - and your device reboots - you will get an immediate prompt to head into the Windows Store and download the entire update.

If you are a TechNet or MSDN subscriber you can download the Windows 8 x86/x64 ISO’s immediately. For Windows RT you must go to preview.windows.com to get it done.

Let's download the bits and start installing evaluations! Hope to upgrade my notebook and Surface RT soon :-)

TechEd 2013 Europe announcements

This week TechEd 2013 Europe is held in Madrid, Spain. Instead of Microsoft Management Summit (MMS) this year, there were a lot of announcements to make. TechEd 2013 North America & Europe seems a better choice this year for new System Center sessions. In this blogpost I will mention the downloads available already.

TechNet Evaluation Center

Windows Server Evaluations
Windows Server 2012 R2 Preview for IT Professionals
Windows Server 2012 R2 Preview on Windows Azure
Windows Server 2012 R2 Preview for Developers
Windows Server 2012 R2 Essentials Preview
The Admin password for the Windows Server 2012 R2 Preview VHD is R2Preview!

System Center and Windows Intune Evaluations
System Center 2012 R2 Preview Datacenter/Private Cloud
System Center 2012 R2 Configuration Manager & Endpoint Protection Preview
Windows Intune 30 Day Free Trial

SQL Server Evaluations
SQL Server 2014 Community Technology Preview 1
SQL Server 2014 Community Technology Preview 1 on Windows Azure

Windows Azure Evaluation
Windows Azure Free Trial

Windows Azure Pack
Windows Azure Pack

Windows 8.1 Preview
Windows 8.1 Preview (available tomorrow)
Remote Server Administration Tools for Windows 8.1 Preview
Windows Assessment and Deployment Kit (ADK) for Windows 8.1 Preview

Guides
Windows Server 2012 R2 and System Center 2012 R2 Evaluation Guide

Let's download the bits and start installing evaluations!

Updates and New Features in ConfigMgr 2012 R2

Last week I was at Windows Management User Group (WMUG) NL day with Wally Mead. Wally Mead has been with Microsoft for more than 21 years, and working with Systems Management Server since SMS 1.0 was in development. The following Updates and New Features for ConfigMr 2012 R2 were mentioned: 

What’s new in ConfigMgr 2012 R2

• Cumulative Updates will be released quarterly
• R2 will be RTM end of year, Beta release coming soon (!)
• There is no change in SQL Collation during installation
• Reassign Site feature possible for multiple sites scenarios
• Multiple network access accounts per site are supported for untrusted forests
• There will be better detailed messages so no need to look at logfiles every time :)
• New report: Distribution Point usage (clients accessed, requests process, bytes send)
• With Pull Distibution Points you can save bandwidth during synchronizing
• Upgrade to R2 is possible only from ConfigMgr SP1 with Windows ADK 8.1
• Windows 2012 R2 and 8.1 support, VHD management, MDT integration
• Native integration of some MDT actions by default, without MDT integration needed: MDT validate action, MDT gather action, Set PowerShell execution policy actions
• Maintenance windows specific to updates and ADR filter query preview
• Two new software updates templates for patch Tuesday and definition updates
• Enrollment UI for MAC computers, no command line needed anymore

Deploying and Managing Windows 8.1 with ConfigMgr 2012 R2

• Resultant client settings in console when having multiple policies  (RSOP)
• Uninstall ADK 8.0 and install ADK 8.1 when using ConfigMgr SP1
• For R2 a minimum of Windows Server 2008 R2 OS is needed
• No support for Windows XP in Windows ADK 8.0 & 8.1 anymore
• Support for Windows PE 3.1 boot images above of Windows ADK 8.1
• VHD upload to Virtual Machine Manager, no VHD deployment possible
• Surface Pro May 2013 driver pack, OSD guide for MDT and CM available
• PXE support for Surface Pro OSD available by USB dongle only (!) 

Unified Device Management: ConfigMgr 2012 R2 Integrated with Windows Intune  

• Windows Intune, less than 7000 devices and 4000 users supported
• Choice between Company-owned or Personal-owned to decide management; Personal devices, inventory of deployed apps only; Corporate devices, inventory of all apps possible (exception for Apple)
• Unified Modern Device Management is the new name for ConfigMgr 2012 R2 integrated with Intune
• Windows Intune can be used standalone or integrated in ConfigMgr 2012 R2 to support more devices & users
• There will be a native company portal app for Windows, iOS and Android in ConfigMgr 2012 R2 with Intune integration
• Registering and Enrolling devices with Workplace Join and Windows Intune through the cloud
• VPN profle management, Wi-Fi support and Certificate management
• New site role, certificate registration point

ConfigMgr 2012 R2 will provide a lot of new functionality above of existing ConfigMgr 2012 SP1 features. R2 will be RTM end of year, Beta release coming soon (probably this week already).

Cumulative Update 2 for ConfigMgr 2012 SP1 released

Today Cumulative Update (CU) 2 for ConfigMgr 2012 SP1 is released. It contains 18 fixes and updated support for Linux and UNIX clients. With CU2 it's possible to add WinPE 3.1 boot images for VMWare Workstation and ESX Server support. More about that issue here: BSOD in VMware 4.1 when booting with WinPE 4.0 images

Here's a list of the issues that are fixed:
- Administrator console (2 fixes)
- Application Virtualization (2 fixes)
- Operating system deployment (4 fixes)
- Asset Intelligence (1 fix)
- Mobile device management (1 fix)
- Software distribution (3 fixes)
- Updated list of supported Linux and UNIX clients
- Site systems (3 fixes)
- Configuration Manager SDK (1 fix)
- Client (1 fix)
- Cumulative Update Setup Wrapper (Installer)

Just install it in your environment when experiencing problems described in this article. When not affected by these problems, Microsoft recommends to wait for the next service pack that contains this update.

This update replaces Cumulative Update 1 for System Center 2012 Configuration Manager Service Pack 1

For more information or download the update have a look here:
Microsoft Support

Offline Image Servicing in ConfigMgr 2012 SP1

Within ConfigMgr it's possible to inject software updates in a reference image. This feature is called Offline Servicing. That way a default Install.wim can be used and updated within ConfigMgr without using a Build and Capture task sequence. It's really a great feature, which saves you multiple hours updating images with monthly updates. It will probably take multiple hours to mount the image, inject the updates and unmount the image again. Don't forget the last step needed after Offline Servicing: Update the Distribution Point (as usual). This because the proces doesn't do that for you. Otherwise the reference image will be deployed again, and no updates will be seen in Windows. This has happened to me more than once, so take advantage of this.

On the image properties Installed Updates can be seen. There's a tab for Servicing also, to see which updates are scheduled.

After deploying the image, software updates will be displayed in Control Panel as usual. No difference at all with a default installation.

Source: Offline Image Servicing in ConfigMgr 2012

Workaround for installing Office updates during task sequence

Last week I created a new task sequence used for App-V Sequencer deployment. Therefore I created a new Windows Server 2008 R2 image without updates, and installed them later by offline servicing the reference image. The total number of updates that were succesfully applied on the mounted image was 134 in total. Because of MS Office 2010 installation, it was needed to deploy additional Office updates during the task sequence installation also. Because installing software updates during deployment isn't that easy, I used a script for that. Let's have a look at it now.

Create a new file on your ConfigMgr server named OfficeUpdates.vbs and copy beneath content in it.

Const ForAppending = 8
Set oFSO = CreateObject ("Scripting.FileSystemObject")
Set oLogFile = oFSO.OpenTextFile ("C:\ConfigOfficeUpdates.txt", ForAppending, True)
oLogFile.WriteLine "Starting execution of VBScript to configure Office to use Microsoft Updates"
Set ServiceManager = CreateObject("Microsoft.Update.ServiceManager")
ServiceManager.ClientApplicationID = "My App"

' add the Microsoft Update Service by GUID
Set NewUpdateService = ServiceManager.AddService2("7971f918-a847-4430-9279-4a52d1efe18d",7,"")
oLogFile.WriteLine "Script completed successfully"
wscript.Quit(oLogFile.Close)

Create a new package of the above file, without a program, and place it on your Distribution Point. Now add a Run Command Line step in your task sequence, with command "cscript OfficeUpdates.vbs" and select the new package created. Trick is to install MS Office 2010 first, then run the above script, and use a default "Install Software Updates" step after that, selecting "All Software Updates". When you change order, it won't be functional. Because of running the above script, Office updates will be installed only!

After using this script 38 Office updates were installed successfully in my environment! Love it :-)

Source: Workaround for Installing Office Updates During an Image Build

Controlling Configuration Manager 2012 Using Hidden Files

There are some files that you can use in order to activate or deactivate some features in ConfigMgr 2012 on client side or server side, such as preventing Software Inventory for a particular folder or preventing the installation of ConfigMgr files on a machine. Here’s some information on some of those files and how you might use them to control your Configuration Manager environment.  The files are as follows:

• NO_SMS_ON_DRIVE.SMS
• ARCHIVE_REPORTS.SMS
• SKPWI.DAT

 
Let's have a look at them.
 
SKPWI.DAT: This file can be used for skipping the Software inventory Process for a partition or for a folder. If you want to prevent software inventory on a drive/partition or folder you can create a hidden file named SKPWI.DAT and place it on the root of the drive/partition/folder.
 
NO_SMS_ON_DRIVE.SMS: This file is used to prevent ConfigMgr from installing binaries to a volume. By default, when you install ConfigMgr on a remote Site System, the SMS Site Component Manager Service installs the binaries (files and folders) for the Site System on the NTFS-formatted volume that contains the most free space. You may want to use an NTFS volume other than the default volume for your remote Site Systems by preventing ConfigMgr from enumerating certain NTFS volumes.
 
ARCHIVE_REPORTS.SMS: This is a client side file and is used when Hw/Sw inventory troubleshooting needs to be done. When troubleshooting ConfigMgr client software or hardware inventory, you might want to retain the XML files that contain details on what the latest scan discovered (regardless whether the scan was a full scan or just a delta).

More information on this can be found on MS TechNet.

Move a Distribution Point Content Library Between Drives

When installing a Distribution Point (DP) during ConfigMgr installation, it will be placed on the disk with the most free diskspace. When you install it afterwards a selection of disks can be choosed. Even better is to place a NO_SMS_ON_DRIVE.SMS file on all drives where you don't want a DP. They will be excluded next time.

When the DP is already installed on the wrong drive or when it must be moved to another location, ContentLibraryTransfer.exe can be used.

ContentLibraryTransfer.exe is a tool that will move a distribution point’s content store from one drive to another. That's it, and it is a very simple process.

The syntax used with the tool is – ContentLibraryTransfer.exe –SourceDrive <Current Drive Letter> -TargetDrive <New Drive Letter>

The ContentLibraryTransfer.exe respects NO_SMS_ON_DRIVE.SMS files. In other words if the drive specified as the TargetDrive contains a NO_SMS_ON_DRIVE.SMS the ContentLibraryTransfer.exe will not copy the content library to this drive.

More information on this can be found on MS TechNet.

Common mistakes during ConfigMgr installation

During my daily work I do a lot of ConfigMgr installations. Because every installation is different (because the design and infrastructure is different) it's still fun to do! Most of times all go well, but there are sometimes a few challenges to pass. In this blogpost I will mention some common mistakes and how to solve them.
 
First of all, make sure preperation is done well! An installation isn't that hard, but both ConfigMgr and SQL needs a good preperation. You can find other posts about prerequisites HERE and HERE. It depends also if ConfigMgr and SQL are installed on the same server or different servers. And it depends if a SQL default instance or named instance is used, if SQL clustering is used, and so on.
 
Common mistakes I experienced last months are: 

1. ConfigMgr Setup requires that the site server computer has administrative rights on the SQL Server and management point computers. SQL Sysadmin permissions are needed also. Just make sure that the needed permissions are in place. More information about possible issues can be found HERE.
2. Make sure that McAfee Access Protection is not active during ConfigMgr Setup, because boot images won't be created or updated. More about that HERE and HERE.
3. When the Windows Firewall is active on the ConfigMgr and/or SQL server, access must be configured as soon as possible. More about that on "Configure the Windows Firewall to Allow SQL Server Access" (MSDN).
4. When using a SQL named instance instead of a default instance, (all) dynamic ports must be removed. This because dynamic ports are not supported in ConfigMgr. Open SQL Server Configuration Manager for that and change the (used) dynamic port to a TCP fixed port.
5. As long as boundaries in ConfigMgr are not added to a boundary group, they won't be active. Systems must be part of boundaries to manage them. Best choice for boundaries is to use IP-ranges, and not IP-subnets.
6. When User Account Control (UAC) is active on the ConfigMgr and/or SQL server, things will go wrong during Setup. This because needed permissions are not there, and will mess up all. A good example for this is WSUS (no synchronization possible) and Reporting Services (no ConfigMgr user roles available).
7. IE ESC for admins is a bad thing also. Just disable the setting quickly in Server Manager.
8. When installing Reporting Services for ConfigMgr integration, it's possible that no reports shows up in the ConfigMgr console. This because a domain user (as recommended) is used, and no additional permissions are set on that account. More about that can be found HERE.
9. When installing a Distribution Point (DP) during ConfigMgr installation, it will be placed on the disk with the most free diskspace. When you install it afterwards a selection of disks can be choosed. Even better is to place a NO_SMS_ON_DRIVE.SMS file on all drives where you don't want a DP. They will be excluded next time.
10. And last for now is the SQL Server Browser service. This is disabled by default. When the error "The server was not found or was not accessible. Verify that the instance name is correct and that SQL server is configured." is displayed during installation, just start the service to make it functional again.

Just use ConfigMgr logfiles and event viewer a lot during troubleshooting. Most information can be found there. That's all for now, hope you found something useful in this blogpost.

TechEd 2013 North America announcements

Last week TechEd 2013 North America was held in New Orléans. Instead of Microsoft Management Summit (MMS) this year, there were a lot of announcements to make. In this blogpost I will mention the highlights, and what to expect for the next months. It will be a great year with lot's of new functionality!

What can we expect later this year?

• Windows Server 2012 R2
• System Center 2012 R2
• Windows Intune 5.0 (Wave E)
• SQL Server 2014 (wow, that's fast!)
• Windows 8.1 (with Outlook RT)
• Deployment Toolkit (MDT) 2013

There will also be new features available:

• Windows Azure Pack for Windows Server
• Intune: Workplace join, Selective wipe, Android support
• Azure: No charge for stopped VM's, per minute billing
• Azure: Live migration Compression (faster then default)
• Azure: Live migration RDMA (faster then Compression)
• Hyper-V recovery manager (site by site replication)

Hope you are as excited as I do!

Usage of Microsoft Office 2010 KMS Host License Pack

Another blogpost about KMS again. Before this 2 other blogposts where available, just have a look at that one also:
Key Management Services (KMS) explained
Using KMS Client Setup Keys during deployment  

When setting up KMS a Windows Server KMS key can be installed at first try. When using a Office (2010) key afterwards an error message is displayed.
Error: 0xC004F050 The software licensing service reported that the product key is invalid

This because the Microsoft Office 2010 KMS Host License Pack must be installed first. It can be downloaded at this location: Download Center. During installation the Office 2010 KMS key can be imported succesfully.

More information can be found on Microsoft TechNet also.