Thursday, February 28, 2013

How to monitor weird SNMP devices in Operations Manager

Sponsor post

A much too common scenario, you have a device that you know for a fact supports SNMP, but it's not supported by Operations Manager or by Jalasoft Xian Network Manager. In that case, you can opt to create your own Management Pack for Operations Manager, but that’s kind of a tough job and definitely not something that you’ll enjoy doing. An easier way to get around this is to use Xian Network Manager 2012. It has a simple feature called "Custom Rules" that will make it possible, in just a matter of minutes, to monitor anything you want on those weird SNMP devices.

Adding your weird network devices to Xian Network Manager

The first thing you need to do is add you weird device to Xian NM. Make sure you have SNMP enabled and the IP-address and community string at hand. Click on [Device] in the menu bar followed by [Add]. A small dialog appears, search for "Network Device" and then click OK. Next a screen like the one in figure 1 appears. The only thing you need to do here is provide the IP-address and the community string. If the device is not within the same network you might consider increasing the time out.

Figure 1, Discovering the Network Device

Now click [Finish] and Xian NM will begin to discover the device. As an example, we enabled SNMP on a Windows 2008 R2 server and within 15 seconds the mentioned server appears as a network device in the Xian NM Console, as you can see in figure 2.

Figure 2, The Discovered Network Device

What is monitored out of the box?

Xian NM monitors some standard aspects after the Network Device has been discovered. You can see this by double clicking on the discovered device and going to "active rules". In Figure 3, you can see exactly what is being monitored, Total Traffic, System Uptime and Availability. Total Traffic monitors the traffic flowing over all the interfaces on the devices, which is set with an automatic threshold. This means that Xian NM will define a threshold after monitoring it for 12 hours. System Uptime returns and the name suggests the number of days the device is up and running.

By default, an alert is sent when the device is up for more than 90 days or below. In this way you’re alerted when the device restarts or when the device is due for a maintenance check. Availability checks if the device can be reached through ICMP and SNMP. The default settings can be easily changed according to your needs. Moreover, you can also apply inactive rules which you can see on the right side of the "device properties" window. Simply drag and drop and the wizard will help you to set up the rule.

Figure 3, Device properties of our 'weird' Network Device

Creating a custom rule

Next it’s time to create a custom rule. For our Windows server we are going to add a CPU Load rule.  In the main console click on [Configuration] on the bottom left of the screen. Now select [Rules] and then [Network Device] in the tree view on the left. Right click on the Network Device and click on "Add Custom Rule". Consequently, a dialog window as the one in figure 4 appears. First you have to define some general information regarding your custom rule. Name, Title and Description can go without an explanation.

However, do be careful with the type of rule, most rules are Performance rules. For example, CPU Load, Memory, System Uptime, so if you are not sure choose one of the three. Select Incremental Performance rule for rules that deal with traffic, this type calculates the difference of two points in units per second. Lastly, if you are concerned with Fan status, Interface status or any other status, select Status rule. In our case since we are going to add a CPU load rule we select Performance rule.

Figure 4, The Add Custom Rule Wizard - General

Next you need to set some performance parameters. The most important ones are:
- Maximum and default threshold value, here you define the threshold value that should be shown by default when you apply the rule and the max value the user can assign;
- Unit, what unit are you using? Percentage, Buffers, packets etc.;
- Allow automatic threshold; Enable this option in order to have a rule that can calculate the threshold automatically;
- Applicable Element, over which element the rule is running. Normally you probably need the NetworkDeviceSnmpDeviceElement;
- Rule Category, Normal this is General, but you are free to change this.


The most important part of the setup process is defined under expression. You will see a small XML code, but you don’t need to do much. Copy and paste the OID over the OID that is already shown. However, for our example we made it slightly more complicated. This is due to the fact that our Windows Server has two cores and thus we will have two CPU loads OIDs. What we’ve done is changed the syntax to get the two CPU loads and divide them into two. Through this operation we also discard the variable MyOID. If you take a look at figure 5, you can clearly see what we’ve done. 

Figure 5, defining the syntax to get the average CPU load of the Windows Server which has two cores

The last thing that you need to do in this wizard is fill in the alert data. This is data that will be displayed when an alert is triggered in OpsMgr and gives the user some extra information. Now click [Finish] and the rule will be added in Xian NM. But before we add the Management Pack of OpsMgr, let’s first do a short test to see if the rule runs as expected.

1. Go to the "General Section" of the rules of the Network Device. There you will see the rule you just added. Right click and select "Test Rule", click OK. Now you will be asked to select the device that you want to use to test the rule. Select the device you added earlier;
2. Now a simplified version of the rule wizard will appear. Go immediately to the schedule and set the interval to 5 seconds. (you can opt for another interval if you want);
3. Click on start.
 

Figure 6, Testing your custom rule

After starting the rule a small dialog window like the one in figure 7 will appear. If all is configured correctly, you will see values appearing. If not, select the "alert" tab. If it says that an exception occurred, you probably made a mistake with the OID setting. In that case, go back and adjust the OID settings in the Custom Rule Wizard. Additionally, you can export the result to CSV in case you need to test more than just the rule and if you also want to analyze the value in a different format, for example excel.

Figure 7, Rule test output

Time to create the Management Pack and import it into OpsMgr. This is needed so OpsMgr is aware of the data that could arrive from this new rule and furthermore, to make sure that this information is processed in the correct way. To generate the Management Packs click on "Network Devices" in the rules section, consequently the option "Generate Management Packs" appears in the action panel. Click on it and select a destination folder. Next, you use the normal import procedure to import the generated Management Pack into OpsMgr.

Adding the custom rule

Let’s add the custom rule to your device. Note that as of this moment the rule you created can be added to any device of the same type. So in our case, if we add any other Windows Server we can deploy this rule as well.
1. Double click on the device where you want to add your custom rule;
2. Go to the active rules Tab;
3. Drag and drop the rule from rule list (on the right side) to the running rules list. Note that you can easily distinguish the custom rules since they are blue colored. (see figure 8)


Figure 8, adding a custom rule to your device

4. Now the typical Xian NM rule wizard will appear. Here you have to pay attention to the threshold level and type. If you know which threshold level you need, opt for a manual threshold otherwise choose automatic threshold. This one will monitor the values for a certain period and define a threshold for you, which you can change also later on. Also be careful with the correct interval. You don’t want it to be too low, since that would be complicating the performance of Xian NM and OpsMgr;
5. Now click Finish;
6. The rule will now go in to running state.


What do you see in OpsMgr?

After the new rule has been running for a while and it has past at least one cycle of the interval, you will be able to see performance data and alerts appearing in OpsMgr as long as you enabled it in the rule settings. In figure 9 and 10 you can see the performance data and alerts appear exactly as any other Xian NM rule or actually as any other rule/monitor of OpsMgr.

Figure 9, Performance data of your Custom Rule in OpsMgr

Figure 10, Alerts of the Custom Rule in OpsMgr

Thanks for reading!

Wednesday, February 27, 2013

Veeam is giving away a free pass to TechEd 2013

Sponsor post

Need a Free Pass to TechEd 2013?

In March you could be the big winner of a free full pass to TechEd 2013! Enter NOW for your chance to WIN!


The winner will be selected on March, 18

Please note: Just one winner will receive a free pass to either North America or Europe TechEd (depending on winner’s location).

Register just once and you’ll be automatically entered in every monthly drawing! Already registered? No need to register again!

Tuesday, February 26, 2013

Multicast error 0x80091007 during deployment

Today I want to configure multicast in ConfigMgr 2012 SP1. An important thing to do is enable multicast on the Distribution Point. Another important thing to do is enable multicast on the Operating System image. Just select "Allow the package to be transferred via multicast (WinPE only)" for that. Start a new deployment on a system and multicast should work immediately!?

After configure above settings an error message is displayed during deployment: 0x80091007. Looking in SMSTS.log the following is mentioned: The hash value is not correct. (Error: 80091007; Source: Windows). This can be solved with distribute the package on DP again. Unfortunately this isn't the case. I still get the same error message during deployment.
 
When disable multicast on the Distribution Point, deployment is working again. Is there someone who recognizes this error message and has a solution for it? I found THIS and THIS on MS TechNet, but no answer yet. Hope someone has a solution for me. Thanks!

Update 28-5-2013: Last month at customer location we created 3 images for multicast usage. First image (4GB) went fine immediately. Second image (6GB) went fine after update Distribution Point (DP), before that same error message. Third image (11GB) still isn't working, after multiple update DP actions. Still don't know why it's failing.. error messages are shown in the screenshot.

Update 19-6-2013: Nick send me a possible solution in comments. What you have to do is make sure you don't have a custom Multicast range set - use the setting "Use IPv4 addresses within any range" in the SCCM 2012 multicast tab under Distribution Point properties.

The default is 239.0.0.1 to 239.0.0.254 - if you have a custom range set - it IGNORES it and uses a random address in 239 range anyways. He has tried to statically set a 239 range on both SCCM multicast and WDS multicast settings - ignores them still uses a random address in the 239 range regardless.

On your Cisco core - if your using that - make sure your ACL's and Rendezvous Point ACL for PIM permits the 239 range. As soon as this was done it's all working. > Will try that myself next month!

Friday, February 22, 2013

Moving the SCUP database after installation

After installing System Center Updates Publisher (SCUP) 2011 configuration must be done. SCUP can be connected to a WSUS or SCCM/ConfigMgr 2007 and/or 2012 installation. Just use Update Server or ConfigMgr Server for that. Something else that must be done is moving the SCUP database. This because the database is placed in the active user profile. Oops! In this blogpost I will explain (in a few steps) what must be done.
 
 
By default the SCUPDB.SDF is placed in the [C:\Users\<username>\AppData\Local\Microsoft\System Center Updates Publisher 2011\5.00.1727.0000] folder. This can be checked at Advanced options. To move the database just close the SCUP console. Open the Scup2011.exe.config file, which can be found in the SCUP installation folder.
 
For example: Beneath <Scup.Properties.Settings> and <setting name="SSCEDataFile" serializeAs="String"> add the following line:
<value>D:\SCUP2011\5.00.1727.0000\scupdb.sdf</value>

This way the database is expected on another location. Just move the SCUPDB.SDF file to the same location configured in the Config file. After configuring both steps start the SCUP console again. Have a look at Advanced options again, and see above results. The database is moved to a better place now!

Thursday, February 21, 2013

Software Update Management in ConfigMgr 2012

In ConfigMgr 2012 Software Update Management can be configured. I recommend this always above WSUS, because of better management possibilities and reporting. Software updates can be configured for manual installation or automatic installation (which is new in ConfigMgr 2012). In this blogpost I willl explain both technologies.

Software Update Management has become better and easier then ever before. No need to look for Search folders, Update lists, Deployment templates and Deployment management in the console anymore. Instead there is a Software update catalog, Software update groups, Deployment packages and Automatic deployment rules now, which I will explain next.

When adding Criteria on the Software update catalog, queries can be made. This is like Search folders in the 2007 version. Queries can be saved for later usage, and can contain multiple settings.

For automatic installation, just configure a "Automatic deployment rule". This rule will download all (required) updates and deploy them to a collection (or collections). No need to do anything at all. Software updates will be download and approved automatically. Just watch the reports monthly after the software update installation, and you are fine! Just a very nice new ConfigMgr 2012 feature :)

For manual installation things go a bit different. Select one or more (required) updates in the Software update catalog. Choose to create a new Software update group. Next time you can add them to an existing Software update group, by using "Edit membership". This way you can use a single Software update group for a specific Operating System. From the Software update group updates can be deployed to a collection (or collections).

Note: Just remember to download updates first, before adding them to an existing Software update group. Otherwise above error message is displayed. Well, it's not that hard..

When putting Maintenance Windows on collections, updates will installed only and servers will rebooted only within the defined service window. Just use above configuration for monthly updates instead of using WSUS. Hope it helps!

Wednesday, February 20, 2013

The planning for Jiayu phones in 2013

Because I have a new Jiayu G3 at the moment, which is a really great phone, I think it would be nice to compare all available and upcoming Jiayu phones. This because the G4, G5, G6 and S1 are announced for upcoming releases. Let's have a look at the company first.

You've probably never heard of the brand Jiayu. The company exists since 2009 and focuses on the home market. The company deals with high-end phones. They make phones with good specifications, high quality for a competitive price. The name says it all, Jiayu means [good equipment]. The company does everything in-house.
 
An Jiayu G3 and G4 comparion and specifications can be found HERE already. Jiayu G4 comes in High Edition and Standard Edition.

Let's have a look at the upcoming releases:
 
Jiayu G5:
Behind the 4.5-inch display and under the iPhone body, the Jiayu G5 will boast a quad-core MT6589 processor running at 1.2Ghz, 2GB RAM, 32GB of on-board memory, 3 MP front camera and a 13 MP rear camera. The body is said to measure in at just 7.85mm and will come with a choice of either 1850mAh or 3000mAh batteries.
 
Jiayu G6:
The information about Jiayu G6 is not much. Reportedly it will have a 5.5" screen, carry the latest MT6589 quad-core CPU with full Full HD resolution, oversized battery and stylus support.

Jiayu S1:
The specifications will include a Qualcomm Snapdragon 1.5Ghz quad-core CPU, 2GB RAM, 32GB built-in memory, Adreno 320 graphics and a 5-inch 1080 display with a PPi of 440+. This will be probably my next phone for 2014 :)

Hope you like it as I do!

Thursday, February 14, 2013

How to create a Windows 7 VDI template

With ConfigMgr it's possible to build a Windows 7 VDI template. You can build it manually or even better, in a task sequence. That way the VDI template can be updated at a later time. For VMware View the following (default) script can be used:

================================

Setting Default HKCU values by loading and modifying the default user registry hive
reg load "hku\temp" "%USERPROFILE%\..\Default User\NTUSER.DAT"
reg ADD "hku\temp\Software\Policies\Microsoft\Windows\Control Panel\Desktop" /v SCRNSAVE.EXE /d "%windir%\system32\scrnsave.scr" /f
reg ADD "hku\temp\Software\Policies\Microsoft\Windows\Control Panel\Desktop" /v ScreenSaveTimeOut /d "600" /f
reg ADD "hku\temp\Software\Policies\Microsoft\Windows\Control Panel\Desktop" /v ScreenSaverIsSecure /d "1" /f
reg ADD "hku\temp\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /d " " /f
reg ADD "hku\temp\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache" /v Persistent /t REG_DWORD /d 0x0 /f
reg ADD "hku\temp\Software\Microsoft\Feeds" /v SyncStatus /t REG_DWORD /d 0x0 /f
reg ADD "hku\temp\Software\Microsoft\WIndows\CurrentVersion\Policies\Explorer" /v HideSCAHealth /t REG_DWORD /d 0x1 /f
reg unload "hku\temp"

rem Making modifications to the HKLM hive
reg ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main" /v DisableFirstRunCustomize /t REG_DWORD /d 0x1 /f
reg ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnableSuperfetch /t REG_DWORD /d 0x0 /f
reg ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 0x1 /f
reg ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 0x1 /f
reg ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Disk" /v TimeOutValue /t REG_DWORD /d 200 /f
reg ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Image" /v Revision /t REG_SZ /d 1.0 /f

reg ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Image" /v Virtual /t REG_SZ /d Yes /f
reg ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application" /v MaxSize /t REG_DWORD /d 0x100000 /f
reg ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application" /v Retention /t REG_DWORD /d 0x0 /f
reg ADD "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
reg ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\System" /v MaxSize /t

REG_DWORD /d 0x100000 /f
reg ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\System" /v Retention /t REG_DWORD /d 0x0 /f
reg ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Security" /v MaxSize /t REG_DWORD /d 0x100000 /f
reg ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Security" /v Retention /t REG_DWORD /d 0x0 /f
reg ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl" /v CrashDumpEnabled /t REG_DWORD /d 0x0 /f
reg ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer" /v NoRecycleFiles /t REG_DWORD /d 0x1 /f
reg ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0x0 /f
reg ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0x0 /f
reg ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\system" /v EnableLUA /t REG_DWORD /d 0x0 /f
reg Add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Sideshow" /v Disabled /t REG_DWORD /d 0x1 /f

rem Using Powershell to perform Windows Services modifications
Powershell Set-Service 'BDESVC' -startuptype "disabled"
Powershell Set-Service 'wbengine' -startuptype "disabled"
Powershell Set-Service 'DPS' -startuptype "disabled"
Powershell Set-Service 'UxSms' -startuptype "disabled"
Powershell Set-Service 'Defragsvc' -startuptype "disabled"
Powershell Set-Service 'HomeGroupListener' -startuptype "disabled"
Powershell Set-Service 'HomeGroupProvider' -startuptype "disabled"
Powershell Set-Service 'iphlpsvc' -startuptype "disabled"
Powershell Set-Service 'MSiSCSI' -startuptype "disabled"
Powershell Set-Service 'swprv' -startuptype "disabled"
Powershell Set-Service 'CscService' -startuptype "disabled"
Powershell Set-Service 'SstpSvc' -startuptype "disabled"
Powershell Set-Service 'wscsvc' -startuptype "disabled"
Powershell Set-Service 'SSDPSRV' -startuptype "disabled"
Powershell Set-Service 'SysMain' -startuptype "disabled"
Powershell Set-Service 'TabletInputService' -startuptype "disabled"
Powershell Set-Service 'Themes' -startuptype "disabled"
Powershell Set-Service 'upnphost' -startuptype "disabled"
Powershell Set-Service 'VSS' -startuptype "disabled"
Powershell Set-Service 'SDRSVC' -startuptype "disabled"
Powershell Set-Service 'WinDefend' -startuptype "disabled"
Powershell Set-Service 'WerSvc' -startuptype "disabled"
Powershell Set-Service 'MpsSvc' -startuptype "disabled"
Powershell Set-Service 'ehRecvr' -startuptype "disabled"
Powershell Set-Service 'ehSched' -startuptype "disabled"
Powershell Set-Service 'WSearch' -startuptype "disabled"
Powershell Set-Service 'wuauserv' -startuptype "disabled"
Powershell Set-Service 'Wlansvc' -startuptype "disabled"
Powershell Set-Service 'WwanSvc' -startuptype "disabled"

rem Making miscellaneous modifications
bcdedit /set BOOTUX disabled
vssadmin delete shadows /All /Quiet
Powershell disable-computerrestore -drive c:\
netsh advfirewall set allprofiles state off
powercfg -H OFF
net stop "sysmain"
fsutil behavior set DisableLastAccess 1


rem Making modifications to Scheduled Tasks
schtasks /change /TN "\Microsoft\Windows\Defrag\ScheduledDefrag" /Disable
schtasks /change /TN "\Microsoft\Windows\SystemRestore\SR" /Disable
schtasks /change /TN "\Microsoft\Windows\Registry\RegIdleBackup" /Disable
schtasks /change /TN "\Microsoft\Windows Defender\MPIdleTask" /Disable
schtasks /change /TN "\Microsoft\Windows Defender\MP Scheduled Scan" /Disable
schtasks /change /TN "\Microsoft\Windows\Maintenance\WinSAT" /Disable
================================

Just save above settings into a CMD file and put in the task sequence. Add a Run Command Line step and start it with CMD /C ***.cmd and you are fine. Just nice to have scripts like these!


Source: VMware.com

Tuesday, February 12, 2013

Jiayu G3 vs G4 comparison and specifications

This year I want to order some new mobile phones. First I want the Samsung Ativ S with Windows Phone 8 onboard. Pity enough it's still not available in NL (rumours say it will be available early march). Therefore I ordered a new Chinese phone for the meantime. It's a Jiayu G3 with Android 4.1 Jelly Bean onboard. For the people who doesn't know Jiayu, here's an comparion between the G3 and G4.
 
Jiayu G3 is a latest generation MTK dual-core Android smartphone, the iPhone 5 style appearance, full metal body, 4.5 inch QHD screen with 1280*720 pixel display, 1GB RAM, 8MP rear camera, and Android 4.1 Jelly Bean OS be installed. It's currently one of the best selling phones in China. Not surprising given the selling price. Jiayu G4 can be pre-ordered at the moment, but isn't available yet.

The Jiayu G4 High Edition and Standard Edition are equipped with a 1.2GHz MediaTek MT6589 quad-core processor (GPU SGX544), equipped with 4.7-inch of 720o touch screen (OGS full lamination technology, with border for only 2.9mm) outer layer with gorilla glass 2 generation, built-in 13-megapixel camera and 3 megapixel front-facing camera, while providing the gyroscope distance light Gravity magnetic sensor, dual card dual standby function.

Last week a new phone was announced also: The Jiayu S1. More about that one will be available later. Hope you like it as I do!

Monday, February 11, 2013

Veeam Backup & Replication Cloud Edition

Sponsor post

#1 VM Backup is now cloud ready


Protecting your business against catastrophic data loss is vital, and offsite storage is the key. Although tapes are often used for long-term, secure data storage, public storage clouds provide the reliability you need without the cost or complexity associated with tapes.

Veeam Backup & Replication Cloud Edition makes offsite backup to the cloud easy and lets you use Amazon, Azure or any other leading public storage cloud provider.
 

Watch this short video preview - Youtube
Watch the product overview - PDF
Watch the product page - Veeam

Thursday, February 7, 2013

No bootfiles in RemoteInstall - SMSBoot folder

In ConfigMgr 2007 it was needed to deploy both Boot images to SMSPXEIMAGES$ for OS Deployment. In ConfigMgr 2012 this method is not available anymore. Adding the bootimage to the RemoteInstall folder is now an option in the bootimage properties, named "Deploy this boot image from the PXE enabled distribution point".


After selecting this option, bootfiles will be available in the RemoteInstall - SMSBoot folder automatically. Hope it helps!

Wednesday, February 6, 2013

MMS 2013 Content Catalog available now!

Today the MMS 2013 Content Catalog has become available! Check the MMS site then to get full detail on over 140 technical training sessions offered at MMS with content delving into the 300 and 400 level. Because the Content Catalog was delayed, the early-bird registration pricing is also extended another week.


Just have a look at the sessions:
At this time there are 198 sessions available, devided in 147 breakout sessions, 22 instructor-led labs and 29 self-paced labs.
http://www.2013mms.com/Topic/List

Sessions are about:
  • System Center 2012 SP1 Suite
  • Virtual Desktop Infrastructure (VDI)
  • Application Virtualization (App-V)
  • Windows Server & Hyper-V
  • Microsoft Deployment Toolkit (MDT)
  • Windows Azure (Cloud platform)
  • Windows Intune (Cloud device management)
  • Mobile Device Management
  • Managing Embedded devices

Hope there will be a lot sessions to come about Windows Intune & Mobility! Update follows when more sessions available.

Update: There are 234 sessions available now! More instructor-led labs and self-paced labs are added already.

Tuesday, February 5, 2013

Program Files cannot be located on a Distribution point

In ConfigMgr 2007 or 2012 the following error message can be displayed during boot image loading: "Program Files cannot be located on a Distribution point". This error message (which is still valid in ConfigMgr 2012) can be passed with the following: Select "When no local distribution point is available, use a remote distribution point" in the advertisement/deployment.


I think it's because the client is on a different subnet then the ConfigMgr server/Distribution Point? Anyway, this helps!!

Friday, February 1, 2013

Deployment issue after changing credentials in task sequence

Last week I wrote a blogpost about "Deployment issues with OSDPreserveDriveLetter parameter". In this blogpost I mentioned that OS deployment stops after installing the SCCM client. At the first application mentioned in the task sequence everything stops.

Error message in SMSTS.LOG:
- (__hrMethodRetVal == ((HRESULT)0L)) || (bFailIfMissing == false), HRESULT=80070002 (e:\NTS_SCCM_RELEASE\sms\common\inc\ccmxml.h,582)- 401 - Authentication failure on request with anonymous access, retrying with context credentials.

I solved above issue by creating and deploying a new task sequence, with all same applications and steps in it.
 

Now it comes: The issue has nothing to do with the OSDPreserveDriveLetter parameter, but with change credentials in the task sequence. After changing credentials (for example: Domain Join account and password) in the task sequence, the issue is back again. Errors are same as mentioned above.

Is this issue specific for SCCM 2012 with SP1 and has anyone the same behaviour seen in SP1? I cannot found this on the "List of System Center 2012 SP1 issues" (which is still growing).

I think the SCCM configuration should be okay, because with a copied task sequence it installs all fine again. Strange issue it is..

Update 4-6-2013: For it seems there's still no solution for this. Have seen this issue once at customer location, curious when it happens again..

Wednesday, January 30, 2013

Deployment issues with OSDPreserveDriveLetter parameter

Last time I want to create a Windows 7 reference image in SCCM/ConfigMgr 2012 SP1. The new method for deploying Windows 7 is by INSTALL.WIM. No Setup.exe is used anymore for creating a reference image. By default Windows 7 will be installed on the D: drive. For installing Windows 7 on the C: drive an additional parameter is needed. Just add "OSDPreserveDriveLetter=False" before the Apply OS step, which allows the task sequence to auto-correct the D: issue. Sounds easy isn't it?

Update 4-6-2013:
In the task sequence choose Add > General > Set Task Sequence Variable. Fill in the following information:
- Task Sequence Variable: OSDPreserveDriveLetter
- Value: False
Just add this command before the Apply Operating System step.

Now it comes: When creating a reference image without the parameter, this must be included during OS deployment. When deploying a task sequence without the parameter, everything goes fine, but Windows 7 is installed on the D: drive. When deploying a task sequence with the parameter, deployment stops after installing the ConfigMgr client. No applications are installed and no certificate is available in the ConfigMgr client. Also the ConfigMgr Site can't be found by the ConfigMgr client.

Error message in CCMSETUP.LOG:
- File C:\WINDOWS\ccmsetup\{1AF71F68-6089-4211-ADDC-06DF40606141}\client.msi installation failed. Error text: ExitCode: 1603
- Client installation has failed too many times. Ccmsetup will now abort.

Next thing to try is to create a new reference image with the parameter included. When creating a reference image with above step, the parameter isn't needed anymore during OS deployment. However, OS deployment stops again after installing the ConfigMgr client. At the first application mentioned in the task sequence everything stops.

Error message in SMSTS.LOG:
- (__hrMethodRetVal == ((HRESULT)0L)) || (bFailIfMissing == false), HRESULT=80070002 (e:\NTS_SCCM_RELEASE\sms\common\inc\ccmxml.h,582)- 401 - Authentication failure on request with anonymous access, retrying with context credentials.

I solved above issue by creating and deploying a new task sequence, with all same applications and steps in it. Then it all was working again. I'm happy that it seems to work now, but doesn't get why it didn't the first time? Anyone recognize the error messages?

Sunday, January 27, 2013

New ConfigMgr 2012 and SCEP 2012 SP1 Binaries available!

The binaries for ConfigMgr 2012 and SCEP 2012 have been updated to correct some minor issues. The binaries have been updated at the Download Center, and also on the Technet and MSDN download sites.

For ConfigMgr 2012 SP1, the updated download release of SP1 includes the following hotfix: Installation error 0x800b0101: System Center 2012 Configuration Manager Service Pack 1 client
 
For SCEP, the new binaries include fixed files (Linux/iOS) that were corrupt in the initial release. Microsoft System Center 2012 Service Pack 1 Configuration Manager - Clients for Additional Operating Systems
 
New ConfigMgr 2012 and SCEP 2012 SP1 Binaries available!
MSDN Download Link and Technet Download Link

This means if you downloaded the binaries prior to today (1/25) - you will likely need to re-download them. Source

Note: Don't forget to use the new bits when installing ConfigMgr 2012 SP1 from now on!

Thursday, January 24, 2013

Problems after migrating the ConfigMgr database

At a customer location ConfigMgr was installed on a SQL cluster. ConfigMgr was running fine, and Reporting services was installed on a single node. All went fine. After a few months customer deciced to break down the SQL cluster and migrate databases to single servers. The ConfigMgr database is migrated with help from MS TechNet: Manage Site and Hierarchy Configurations
 
All seems okay after the migration. The ConfigMgr console can be started and no direct errors are seen. After a week looking in the configuration, multiple errors are seen in the logfiles:
 
CCMSETUP.LOG (from a client)
- GetDPLocations failed with error 0x87d00215
- Failed to get DP locations as the expected version from MP "SCCM Server". Error 0x87d00215

CERTMGR.LOG
- Error: Failed to write certificate from server (SQL SERVER\TrustedPeople).
- ERROR: Failed to open certificate store (HRESULT=0x5)

HMAN.LOG
- SMS-Site-S01 could not be created, error code = 8203.
- Failed to connect to remote WMI repository on machine "SQL Server"
ConnectServer(Namespace) failed. - 0x80070005


POLICYPV.LOG
- Failed to sign Policy Assignment, Error code = 0x8009200b
- Error signing policy assignments (0x80004005).

Also multiple errors are seen in the ConfigMgr console:

SMS_HIERARCHY_MANAGER
- Configuration Manager cannot create the object "SMS-Site-S01" in Active Directory
- Hierarchy Monitoring detected that the SQL Server machine certificate has missed. It is failed to remediate with Error.
- Hierarchy Monitoring detected that the SQL Server machine certificate has missed.
 
SMS_SITE_COMPONENT_MANAGER
- Site Component Manager failed to reconfigure site system "SQL Server" to receive Configuration Manager Server Components.
- Site Component Manager could not access site system "SQL Server". The operating system reported error 2147942467: The network name cannot be found.

SMS_POLICY_PROVIDER
- Policy Provider has failed to sign one or more policy assignments. It will retry this operation automatically.

Does anyone has a clue why communication to the ConfigMgr database fails? It seems to be something with permissions, WMI and certiticates. Also reporting isn't functional anymore. ConfigMgr computeraccount is an administrator on both ConfigMgr and SQL Server. Site Reset didn't help me unfortunately.

Update 30-1-2013: Solved with assistance from Stephan Wibier (@StephanWibier) Thanks!

Update 15-5-2013: The trick is to re-create the certificate which is needed for communication between ConfigMgr and SQL Server. Then everything will be okay again. Just follow steps from this blogpost for the permissions needed: "Fail to create SQL Server Certificate" during installation.


As described on Microsoft TechNet also a new self signed certificate is needed which much be assigned in the SQL Server Configuration Manager / SQL Server Network Configuration / Protocols for MSSQLSERVER. Hope it helps!

Boot images not updated after upgrading to ConfigMgr 2012 SP1

This week I had another nice issue in ConfigMgr 2012 SP1. The Boot images were not migrated from WinPE 3.0 (which is Windows 7) to WinPE 4.0 (which is Windows 8). Also Upgrade Distribution Points was generating an error. This because Boot images on WinPE 3.0 are not supported anymore.
 
 
Looking on MS TechNet I found the following post: Boot images not updated after upgrading to SP1 in System Center 2012 Configuration Manager
Another issue has something to do with McAfee Access Protection on the ConfigMgr server. McAfee is blocking the creation of the boot image package: Only finalized boot images are supported 
 
For me this did the trick: 
  • Rename the boot.wim and the default boot wims in each architecture folder of the <smsinstall>OSD\boot\ folder – both the i386 and x64 to <wim>.bak
  • Starting with the i386 folder first...Find the install folder of the ADK, which should be here if you installed with the defaults: “C:\Program Files (x86)\Windows Kits\8.0\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\en-us\winpe.wim”. You will need to copy the winpe.wim to the <smsinstall>OSD\boot\i386 folder. Rename it to boot.wim.
  • You will also need to copy it again, but this time rename it so it matches the name of the default boot wim for the site – so it should look like boot.<packageid>.wim
  • Update default boot image. Click “Execute Method” -> input object path as SMS_BootImagePackage.PackageID="<Image ID you see in the Console e.g. POL00001>" -> UpdateDefaultImage
  • You will need to do this for the x64 folder as well. Do not do this for any custom boot images – this is just to update the default boot wims installed during setup of the site.

After that open properties of both Boot images in ConfigMgr and choose Reload on the Images tab. The OS version 6.2.9200.16384 should be displayed instead of OS version 6.1.7600.16385 now.

After that remove McAfee Access Protection (when installed) to update both Boot images on the ConfigMgr server. The Update Distribution Points Wizard should complete succesfully now.
You will be fine after that!

Wednesday, January 23, 2013

The existing database is not compatible with this version of WSUS

Today I wanted to re-install WSUS again in a production environment where ConfigMgr 2012 was also on place.

Normally these steps are followed:

1) Uninstall WSUS (without database, logfiles, updates)
2) Install WSUS again + KB2720211 + KB2734608 updates
3) Reboot the server (you never know)
4) Start "Synchronize Software Updates"


This time I couldn't connect to the WSUS database anymore. Error message: "The existing database is not compatible with this version of Windows Server Update Services 3.0 SP2. Select another database instance or create a new database"


Looking on the existing WSUS Database I found out that permissions were not correct. After adding the Installation account to the WSUS database with Sysadmin permissions it was working again.

Hope it helps!

Remote configuration failed on WSUS Server (part 2)

Two weeks ago I wrote a blogpost about WSUS issues after a System Center 2012 SP1 upgrade. This blogpost can be found HERE. I mentioned my environment was already provided with KB2720211 and KB2734608, and was working okay before the SP1 upgrade. Looking in the logfiles the following error messages were seen in: "Remote configuration failed on WSUS Server". Here we go again!
 
This time another message is seen in the wsyncmgr.log also, "DB Server not detected for SUP <ConfigMgr FQDN>".
 
 
In the WCM.log there's another error message seen: "Source file C:\Windows\TEMP\********.cs" could not be found. That's a nice one!
 
 
For me this did the trick:
  • Assign NETWORK SERVICE permissions on the Windows\Temp folder (List Folder/Read Data & Delete) 

After that WSUS synchronisation is running fine again! This permissions are needed to let NETWORK SERVICE write to the folder.

Monday, January 21, 2013

"Fail to create SQL Server Certificate" during installation

When installing ConfigMgr 2012 SP1 on SQL Server 2012 with Cumulative Update 2 installed, the following error can be showed: "Fail to create SQL Server Certificate, ConfigMgr installation cannot be completed". 


Looking in the logfile the following errors are showed:
  • Failed to create machine certificate on server <ConfigMgr FQDN>
  • Failed to create certificate on server <ConfigMgr FQDN>
  • Failed to create SQL Server <ConfigMgr FQDN> certificate remotely 

Not seen any error like this before. Prerequisites where all fine. Why this error is showed during installation? Looking on MS TechNet I found the following post: SCCM 2012 won't install due to SQL Server Certificate

Just make sure the following is configured:
  • The account used for the installation and the computer account of SCCM2012 have to be members of the local admins group on SCCMDB2012 and need also sysadmin rights in SQL.
  • Just make sure you configure the SQL services to run under a domain user account rather than as local system or network service. Running SQL under a domain user follows MS best practices.
  • If you already face a failure in installation then delete the registry key which generated during installation of SCCM(HKLM\SOFTWARE\Microsoft\SMS).

After following above steps run setup again. This time "Generating public key and SQL Server certificate" should not give an error anymore.