Atul's blog on SCCM Administration (Automate everything)

vbscript to monitor specific service on multiple Windows Servers

2011-11-30T10:15:00.000+08:00

Hi,

pls find the script for service monitoring on multiple windows servers and do let me know your feedback.

how to run?
-create a separate folder name it anything
-create a txt file name as compname.txt (in case of me, I have used this name under script)
-Input all servers name inside the compname.txt file
-copy and paste the script in notepad and save it as .vbs
-double click on the .vbs file
-log file with current date and time will be automatically generated and you can see the service status inside.

'script to monitor specific service on multiple Windows Servers
'script created by Atul Mishra
'pls check the automatically generated log file for service status
Dim sDate
Dim strTime
Dim strDate
Dim strState
Dim strDataIn           'Input list from text file
Dim aryData                     'Array to hold input stream
Dim iCounter            'Iterative loop counter
dim strOUT                      'Output file
Dim oWshShell           'Windows shell script
Dim objFSO                      'Scripting File System
Dim objFile                     'Open text file
Dim strFilePath         'Path to current directory
Dim strServiceName      'Name of service to be checked

Set oWshShell = CreateObject("WScript.Shell")
Set objFSO = CreateObject("Scripting.FileSystemObject")
strFilePath = objFSO.GetAbsolutePathName(".")

'Get Service Name
strServiceName = InputBox("Enter name of service...", "Service name input")

'Read file into a variable
strDataIn = f_r(strFilePath & "\compname.txt")

'Split into an array
aryData = Split(strDataIn,vbCrLf)
oWshShell.Popup Ubound(aryData) + 1 & " Hosts/Addresses in list." & Chr(13) & "Scan is underway.",2,"Notice",64
sDate = Date
strTime = Now
StrDate = DatePart("m",sDate) & "." & DatePart("d",sDate) & "." & Hour(strTime) & "." & Minute(strTime)
set strOUT = objFSO.CreateTextFile(strFilePath & "\SERVICEResults." & strDate & ".log")
strOUT.WriteLine strServiceName & " query results:"
strOUT.WriteBlankLines (2)
For iCounter = 0 to Ubound(aryData)
aryData(iCounter) = Trim(aryData(iCounter)) ' clean "white space"
If GetService(aryData(iCounter), strServiceName) then
        strOUT.Write aryData(iCounter) & ",Installed : " & strState & vbcrlf
Else
        strOUT.Write aryData(iCounter) & ",Service not present" & vbcrlf
End if
Next
strOUT.Close
set strOUT = nothing
set objFSO = nothing
oWshShell.Popup "Scan processing complete.",5,"Notice",64
WScript.quit

'Given the path to a file, this function will return entire contents
Function f_r(FilePath)
Dim FSO
Set FSO = CreateObject("Scripting.FileSystemObject")
f_r = FSO.OpenTextFile(FilePath,1).ReadAll
End Function
'Returns True or False based on the status of the specified Service
Function GetService(strComputer, strSrvce)
On Error Resume Next
Dim objWMIService
Dim colListOfServices
Dim objService
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colListOfServices = objWMIService.ExecQuery _
    ("Select DisplayName,State from Win32_Service Where Name = '" & strSrvce & "'")
If Err.Number <> 0 Then
GetService = "False"
Err.Clear
Else
For Each objService in colListOfServices
GetService = "True"
strState = objService.State
Next
End If
End Function

Please let me know your views.
Cheers!

vbscript to fix WSUS client issue

2011-11-30T09:37:00.000+08:00

Hi,

Please find the script to make your infrastructure environment 100% patch compliant and do let me know the feedback. It will help admins to fix WSUS client issue and can help them to automate the fix and reduce no of tickets :)

Here we go,

'script will use wmi to do the following on a local computer
'Created by Atul Mishra
' Supported OS - Win XP, Win7, Win 2003 server, Win 2008 server
'1. Stop the Automatic Updates Service
'2. Delete the %WINDIR%\softwaredistribution folder
'3. Delete the HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate keys and subkeys.
'4. Start the Automatic updates Service
'5. Send a wuauclt.exe /resetauthorization /detectnow command to sysem
'6. Initiate software update scan cycle actions
dim objFSO, objShell, objTempFile, objTS
dim sCommand, sReadLine
dim oCPAppletMgr 'Control Applet manager object.
dim oClientAction 'Individual client action.
dim oClientActions 'A collection of client actions.
'dim bReturn
set objShell = WScript.CreateObject("Wscript.Shell")
set objFSO = CreateObject("Scripting.FileSystemObject")
strComputer = "."
'----------------Stop Automatic Updates Service--------------------
'
'
'On Error Resume Next
' NB strService is case sensitive.
strService = " 'wuauserv' "
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")
Set colListOfServices = objWMIService.ExecQuery _
("Select * from Win32_Service Where Name ="_
& strService & " ")
For Each objService in colListOfServices
objService.StopService()
Next
WScript.Echo "Service has been stopped"
'
'
'
'----------------- Delete Folder and Reg Keys --------------------------------
strExe = "cmd.exe /C rmdir %WINDIR%\SoftwareDistribution /S /Q && cmd.exe /C REG DELETE HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate /f"
' Connect to WMI
'
set objWMIService = getobject("winmgmts://"_
& strComputer & "/root/cimv2")
' Obtain the Win32_Process class of object.
Set objProcess = objWMIService.Get("Win32_Process")
Set objProgram = objProcess.Methods_( _
"Create").InParameters.SpawnInstance_
objProgram.CommandLine = strExe
'Execute the program now at the command line.
Set strShell = objWMIService.ExecMethod( _
"Win32_Process", "Create", objProgram)
WScript.Echo "The software Distribution Folder and WindowsUpdate regsitry keys have been deleted."
'------------------ Start Automatic Update Service -------------
'On Error Resume Next
' NB strService is case sensitive.
strService = " 'wuauserv' "
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")
Set colListOfServices = objWMIService.ExecQuery _
("Select * from Win32_Service Where Name ="_
& strService & " ")
For Each objService in colListOfServices
objService.StartService()
Next
WScript.Echo "Service has been Started on " & strcomputer

'-------------- Force Checking to WSUS server by issueing a wuauclt.exe /resetauthorization /detectnow ------------

strExe = "cmd.exe /C wuauclt.exe /resetauthorization /detectnow"
' Connect to WMI
'
set objWMIService = getobject("winmgmts://"_
& strComputer & "/root/cimv2")
' Obtain the Win32_Process class of object.
Set objProcess = objWMIService.Get("Win32_Process")
Set objProgram = objProcess.Methods_( _
"Create").InParameters.SpawnInstance_
objProgram.CommandLine = strExe
'Execute the program now at the command line.
Set strShell = objWMIService.ExecMethod( _
"Win32_Process", "Create", objProgram)
WScript.Echo "Force checkin has been sent. Process Complete."
'Initiate software update scan cycle actions
'Get the Control Panel manager object.
set oCPAppletMgr=CreateObject("CPApplet.CPAppletMgr")
if err.number <> 0 then
    Wscript.echo "Couldn't create control panel application manager"
    WScript.Quit
end if
'Get a collection of actions.
set oClientActions=oCPAppletMgr.GetClientActions
if err.number<>0 then
    wscript.echo "Couldn't get the client actions"
    set oCPAppletMgr=nothing
    WScript.Quit
end if
'Display each client action name and perform it.
For Each oClientAction In oClientActions
    if oClientAction.Name = "Software Updates Assignments Evaluation Cycle" then
        wscript.echo "Performing action " + oClientAction.Name
        oClientAction.PerformAction
    end if
next
set oClientActions=nothing
set oCPAppletMgr=nothing

If you have some more thoughts, please share. I would like to script your thoughts to automate the administration.

Cheers!

Status message query to find out all sccm servers with specific component status

2011-06-06T10:31:00.000+08:00

select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on ins.RecordID = stat.RecordID left join SMS_StatMsgAttributes as att1 on att1.RecordID = stat.RecordID where stat.Component = "SMS_EXECUTIVE" and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time DESC

Cheers!

Collection query to list all clients where advertisement was not succeeded

2011-04-27T20:18:00.000+08:00

We can create a collection with the below dynamic query to list all clients where specific advertisement was not successful. All you need to change the advert ID and use it to your production environment to make management happy by reports.

SMS_R_SYSTEM.ResourceID not in (select SMS_ClientAdvertismentStatus.ResourceID from SMS_ClientAdvertisementStatus where SMS_ClientAdvertisementStatus.AdvertisementID = "ADV20408" and SMS_ClientAdvertisementStatus.laststatusmessageID in (10009))

Cheers!

WMI Commands to perform SCCM actions

2011-04-27T19:48:00.000+08:00

Here we go; WMIC is tool which can be used as command line and perform below sccm actions -

Disable Software-Distribution:
WMIC /namespace:\\root\ccm\policy\machine\requestedconfig path ccm_SoftwareDistributionClientConfig CREATE ComponentName="Disable SWDist",Enabled="false",LockSettings="TRUE",PolicySource="local",PolicyVersion="1.0" ,SiteSettingsKey="1" /NOINTERACTIVE

Re-Activate Software-Distribution:
WMIC /namespace:\\root\ccm\policy\machine\requestedconfig path ccm_SoftwareDistributionClientConfig WHERE ComponentName="Disable SWDist" delete /NOINTERACTIVE

Trigger Hardware Inventory:
WMIC /namespace:\\root\ccm path sms_client CALL TriggerSchedule "{00000000-0000-0000-0000-000000000001}" /NOINTERACTIVE

Trigger Software Inventory:
WMIC /namespace:\\root\ccm path sms_client CALL TriggerSchedule "{00000000-0000-0000-0000-000000000002}" /NOINTERACTIVE

Trigger DataDiscoverRecord (DDR) update:
WMIC /namespace:\\root\ccm path sms_client CALL TriggerSchedule "{00000000-0000-0000-0000-000000000003}" /NOINTERACTIVE

Force a FULL HW Inventory on next HW-Inv Schedule:
WMIC /namespace:\\root\ccm\invagt path inventoryActionStatus where InventoryActionID="{00000000-0000-0000-0000-000000000001}" DELETE /NOINTERACTIVE

Repair SMS/SCCM Agent on a remote client:
WMIC /node:%MACHINE% /namespace:\\root\ccm path sms_client CALL RepairClient

Repair a list (all clients listed in clients.txt) of remote SMS/SCCM Agents:
WMIC /node:@clients.txt /namespace:\\root\ccm path sms_client CALL RepairClient

Cheers!

Run commands for SCCM clients

2011-03-04T19:01:00.000+08:00

These are few things which I have shared for loving helpdesk engineers who help us to achieve healthy sccm environment.

ccmsetup - for checking ccmsetup installation and uninstallation activity logs
ccm - for checking downloaded content cache, client's logs, inventory, metering and other client related information
ccm/smsrap.cpl - for checking available programs listed on client's Run Advertised Programs under Control panel

Cheers!

Mastering SCCM - Step by step guide for SCCM

2011-02-20T22:17:00.000+08:00

Tremendous efforts have been made by anyweb (Niall Brady, founder of windows-noob). New SCCM admins can refer this step by step guide to get a thorough idea of SCCM functionalities.

Please refer to below link-
SCCM 2007 step by step Guide

Cheers.

Client installed but showing as 'No' to SCCM console - troubleshooting tips #4

2011-02-20T22:02:00.001+08:00

Hi Again,

While SCCM admins plan to upgrade sms client to sccm client and you have a large SCCM infrastructure with multiple sites, make sure that you have configured site code within client push installation method of primary sites or if you have planned to upgrade clients with software distribution methods, don't use auto discovery for all clients, it can cause you a large no of unhealthy clients. You will see number of clients which have client installed but showing as 'No' to sccm console. To eliminate this, you can prepare site wise client upgrade package and can deploy it to respective sites.

One more good option is to prepare a script which will discover client's site boundary (AD site) and assign site code immediately. this script can be deploy to all clients within your sccm infrastructure centrally.

Anyway, if you have such computers in which client is installed but showing 'No' in console, one more option is to set the correct site code and resolve the issue.

Hope it helps.

Clarifications on my previous posts

2011-02-20T21:42:00.000+08:00

I started this blog for SMS Admins so that they can get all relevant information from here. Earlier, I was adding few important points of SMS 2003 from Microsoft technet library which have helped new admins working on SMS.

There are several blogs, tutorials and e-learning portals where people can have a look but they don't do so because of time constraint, I help them to see all relevant administrative tips on my blog portal.

If anyone has any comments about my blog, please let me know with your name and email id. I welcome your thoughts.

Anonymous comments would be treated as spam message and will be deleted immediately.

Cheers!

My Next Milestone 'Solutions Architect' by 2012

2011-02-06T01:03:00.000+08:00

I am just understanding the responsibilities of 'Solutions Architect' and below are my findings about SA roles -

Assist in the refinement of business requirements
Respond to business requirements with feasible technical solutions
Provide an architectural design for the selected solution that:
Helps the customer verify that they're satisfied with what they're getting
Provides a blueprint for the project manager to plan with
Informs the constructors so that they can estimate cost & effort
Liaise with:

The customer to ensure alignment with requirements
The project manager to identify appropriate constructor engagement
Constructors to validate feasibility & provide support throughout construction
Write & present eloquently with the appropriate audience perspective in mind
Build & maintain excellent relations with key stakeholders
Apply their creative skills & talents in devising effective designs (a.k.a. thought leadership)
Continuously expand their knowledge & specialisation of technology & design patterns

Finally, I can conclude that SA role is a Subject Matter Expert role who actively involves with Project Management team and helps Project manager to take decisions with expert judgement.

Cheers!

can't reinstall sccm client on machine 'MSI: Could not delete key'

2011-02-06T00:52:00.000+08:00

Please find below scenarios with respective troubleshooting steps- MSI: Could not delete key \SOFTWARE\Classes\CLSID\{84ECA343-5158-48BB-87C3-37EF4B919F20}. Verify that you have sufficient access to that key, or contact your support personnel.

Open command prompt window with run as account domain\smsclient account (to avoid any access related issue)
Run ccmclean .exe /Q /All (I know that we can remove sccm client with ccmsetup.exe /uninstall switch but it seems that legacy sms client settings prevent sccm upgrade and thus, it needs to be uninstalled properly)
Run installsccm.bat file on machine to install sccm client (please verify ccmsetup.log file for successful installation)

MSI: Setup was unable to create the WMI namespace CCM\SoftwareMetering Agent The error code is 80041002

Open command prompt window with run as account tp1\srvsmsclinst (to avoid any access related issue)
Run ccmclean .exe /Q /All (I know that we can remove sccm client with ccmsetup.exe /uninstall switch but it seems that legacy sms client settings prevent sccm upgrade and thus, it needs to be uninstalled properly)
Run setWMI.bat to repair WMI (I use below script and have got 100% success @all time)
Run installsccm.bat file on machine to install sccm client (please verify ccmsetup.log file for successful installation).

'setWMI.bat
'script here
net stop ccmexec

net stop winmgmt
%SYSTEMDRIVE%
CD %windir%\system32\wbem
rd /S /Q repository
net start winmgmt
net start ccmexec
for /f %%s in ('dir /b /s *.dll') do regsvr32 /s %%s
for /f %%s in ('dir /b *.mof') do mofcomp %%s
wmiprvse /regserver

Hope it helps.

Microsoft SCCM 2012 (vNext) in Cloud computing environment?

2011-01-31T23:48:00.002+08:00

Microsoft introduces Dynamic Datacenters to deliver cost effective solutions and is integrating
System Center products with private cloud computing foundations. These products are-

System Center Data Protection Manager
-- for data protection and recovery

System Center Configuration Manager
-- to design, configure and deploy

System Center Service Manager
-- for IT Service Management

System Center Operations Manager
-- to monitor and manage service end to end

System Center Virtual Machine Manager
-- to virtualize, deploy and manage

Opalis
-- IT Process Management

I am trying to get some news how these products work under cloud computing environment and will share you soon.

Cheers!

Go Green for IT - Implement Cloud Computing Infrastructure

2011-01-31T23:35:00.005+08:00

Cloud computing is virtualized compute power and storage delivered via platform-agnostic infrastructures of abstracted hardware and software accessed over the Internet. These shared, on-demand IT resources, are created and disposed of efficiently, are dynamically scalable through a variety of programmatic interfaces and are billed variably based on measurable usage.

Cloud "Applications"
Examples: SalesForce, Gmail, Yahoo! Mail, Quicken Online

Advantages: Free, Easy, Consumer Adoption
Disadvantages: Limited functionality, no control or access to underlying technology

Cloud "Platforms"
Examples: Google App Engine, Heroku, Mosso, Engine Yard, Joyent or Force.com (SalesForce Dev Platform)

Advantages: Good for developers, more control than “Application” Clouds, tightly configured
Disadvantages: Restricted to what is available, other dependencies

Cloud "Infrastructure"
- Provide “Compute” and “Storage” clouds
- Virtualization layers (hardware/software)

Examples: Amazon EC2, GoGrid, Amazon S3, Nirvanix, Linode
Advantages: Full control of environments and infrastructure
Disadvantages: premium price point, limited competition

Cloud "Extenders"
- Provides extension to Cloud Infrastructure and Platforms with basic functionality

Examples: Amazon SimpleDB, Amazon SQS, Google BigTable
Advantages: Extends functionality of Compute & Storage Clouds to integrate with legacy system or other clouds
Disadvantages: Sometimes requires use of specific Platforms or Infrastructure

Cloud "Aggregators"
- Sits on top of various Cloud Infrastructures for management
Examples: RightScale, Appistry
Advantages: Provides more options for Cloud environments
Disadvantages: Dependent on Cloud Providers
Hosting Heads to the Clouds
Static -> Dynamic = Quick & Easy Scalability
Cost Prohibitive -> Cost Effective = Cost Efficiencies
Predictable -> Unpredictable = Innovations
Stagnant -> Growth = Evolution
Traditional Hosting -> Cloud Hosting = FUTURE!

sources: http://blog.GoGrid.com

Optimize your IT Infrastructure with cost effective solutions

2011-01-20T19:07:00.001+08:00

One of the most admiring thing of Microsoft is to be very customer oriented and to provide best solution/services within optimum cost. I really appreciate that MS always focuses on business needs and there are timely enhancements of MS technologies.

Generally, Organization looks for optimized IT Infrastructure withing its production environment and it's like investing on IT resources as below-

Infrastructure Setup need Servers and workstations
Servers need servers management tools
Server management tools need server administrators
Server Administrators need skills upgrade (Trainings & Certifications)
Workstations need few agents to be managed properly
agents need system engineers
If company is medium or large scale enterprise, it further requires Global Service Desk and Onsite Service Desk

As IT consultant, I think, now Microsoft is coming with solutions as

Infrastructure Setup need Servers and workstations

-- Cloud Computing, Virtualization

Servers need servers management tools
-- System Center products (SCCM, SCOM, etc)

Server management tools need server administrators
-- MS might come up with Artificial Intelligence

Server Administrators need skills upgrade (Trainings & Certifications)
-- Virtual Labs

Workstations need few agents to be managed properly
-- SCCM Client (for Managing)

Workstations need system engineers to troubleshoot any issues
(If company is medium or large scale enterprise, it further requires Global Service Desk - GSD and Onsite Service Desk - OSS)
If it's GSD - MS is coming up with Service Manager 2010 (SCSM 2010 provides built-in processes based on industry best practices for incident and problem resolution, change control, and asset lifecycle management. Through its configuration management database (CMDB) and process integration, Service Manager automatically connects knowledge and information from System Center Operations Manager, System Center Configuration Manager, and Active Directory Domain Services)

If it's OSS - TIFIC (finally recommended)

Why TIFIC?
IT environment presents a difficult challenge for IT Service Support organizations who are facing the reality of “doing more with less” — while improving customer satisfaction. End users support presents a unique challenge due to the shear number of applications (productivity, line-of-business, etc.), that many users have gone mobile and that the typical end user computing environment is going through constant change, which we all know is the root cause of most problems.

The net result is an overwhelmed, reactive IT support staff that and are facing some difficult challenges.

Higher call volumes, longer wait times and higher abandonment rates
Longer support calls
Lower first time fix rates and more costly escalations
Declining customer satisfaction

Utilizing Support Automation technologies, Enterprise IT Service Support organizations can reap significant business benefits that include:

Transform the support organization from being reactive to being proactive — thereby increasing end-user and support staff productivity and satisfaction.
Reduce the support load (fewer calls) on the service desk through automated resolution of known problems.
Reduce the AHT (Average Handling Time)
Increase FTR (First Time Resolution), eliminating costly escalations
Improve end user satisfaction

note - pls go thru link for more information on TIFIC http://www.tific.com/?page_id=13

I will come up with Cloud computing concepts soon.
Cheers!

Tips for SCCM Client Upgrade/Reinstall

2011-01-13T09:08:00.000+08:00

If you are upgrading sms clients to sccm, you can run sccm client setup file directly to machines as it automatically detects any legacy version of sms and removes (uninstalls) it.

but if you have any problem with existing SCCM client and you really want to reinstall client to make it healthy, don't run ccmsetup.exe file directly to machine, first uninstall sccm client using ccmsetup.exe /uninstall from machine and then install it.

Note: Always try to lookup on sccm client logs for better troubleshooting and try repair client if it was working earlier and finally reinstall it.

Client installed but showing as 'No' to SCCM console - troubleshooting tips #3

2011-01-13T08:57:00.000+08:00

It's better to understand the difference between reinstalling sccm client and repairing sccm client. When you reinstall a client, it creates SMS classes in WBEM repository, initiates policies for notification to SCCM management point and gets new SMS GUID as an identification but it won't delete the exisitng GUID (SMS keeps it until we delete certificate using ccmdelcert.exe from the toolkit.. or uninstall sccm client porperly). SMS identifies it as new record and acts on it as new client. If you have added this machine to somewhere your system based collection, it won't be getting any policies. Machine, having old GUID certificate, would be negligable and policies would be rejected from respective Management point.
While, if you repair a client; it removes old certs, assigns it new certificate and initiates policies as unique record. It works properly and policies are apporved by MP.

Cheers!

Client installed but showing as 'No' to SCCM console - troubleshooting tips #2

2011-01-08T19:42:00.000+08:00

During troubleshooting this strange behaviour, I got to know that if sms clients are not upgraded as sccm clients, they will show status as Client installed 'Yes' but it won't be approved by site and will not work properly.

In other scenario, it might show client installed status as 'No' if your client is not upgraded or is not assigned to respective site.

You need to query all clients with legacy version and install sccm client on these machines.

Microsoft's next thought after vNext- Artificial Intelligence?

2011-01-08T19:33:00.000+08:00

No idea, whether MS is working on it but yes, it's something MS should take into consideration after virtualization. Artificial Intelligence (AI) is the area of computer science focusing on creating machines that can engage on behaviors that humans consider intelligent. The ability to create intelligent machines has intrigued humans since ancient times, and today with the advent of the computer and 50 years of research into AI programming techniques, the dream of smart machines is becoming a reality. Researchers are creating systems which can mimic human thought, understand speech, beat the best human chessplayer, and countless other feats never before possible. Find out how the military is applying AI logic to its hi-tech systems, and how in the near future Artificial Intelligence may impact our lives.

SQL query to get all workstations having .NET Framework version less than 2.0

2011-01-05T09:46:00.000+08:00

Below is SCCM query to get all workstations having .NET Framework version less than 2.0-

select distinct (a.name0), a.user_name0, a.operating_system_name_and0, b.productname, b.productversion from v_R_System a, v_GS_SoftwareProduct b
where a.ResourceID = b.ResourceID
and a.Operating_System_Name_and0 like '%workstation%'

and b.ProductName like '%NET Framework%'
and b.ProductVersion< '2.0%'

Thanks!

SQL query to get packages which are advertised without updating DPs

2010-12-23T21:57:00.000+08:00

SELECT dbo.v_Advertisement.AdvertisementID, dbo.v_Advertisement.AdvertisementName, dbo.v_Advertisement.CollectionID,

dbo.v_Advertisement.PresentTime, dbo.v_Advertisement.ExpirationTime, dbo.v_Advertisement.SourceSite, dbo.v_Package.PackageID,
dbo.v_Package.Name, dbo.v_Package.Version, dbo.v_Package.SourceVersion, dbo.v_Package.SourceDate, dbo.v_Package.LastRefreshTime,
dbo.v_DistributionPoint.ServerNALPath, dbo.v_DistributionPoint.SiteCode, dbo.v_DistributionPoint.SiteName,
dbo.v_DistributionPoint.LastRefreshTime AS Expr1, dbo.v_DistributionPoint.Status, dbo.v_PackageStatusDistPointsSumm.ServerNALPath AS Expr2,
dbo.v_PackageStatusDistPointsSumm.SourceVersion AS Expr3, dbo.v_PackageStatusDistPointsSumm.SiteCode AS Expr4,
dbo.v_PackageStatusDistPointsSumm.State, dbo.v_PackageStatusDistPointsSumm.LastCopied, dbo.v_PackageStatusDistPointsSumm.SummaryDate,
dbo.v_PackageStatusDistPointsSumm.InstallStatus
FROM dbo.v_Advertisement INNER JOIN
dbo.v_Package ON dbo.v_Advertisement.PackageID = dbo.v_Package.PackageID INNER JOIN
dbo.v_DistributionPoint ON dbo.v_Package.PackageID = dbo.v_DistributionPoint.PackageID INNER JOIN
dbo.v_PackageStatusDistPointsSumm ON dbo.v_DistributionPoint.PackageID = dbo.v_PackageStatusDistPointsSumm.PackageID
WHERE dbo.v_PackageStatusDistPointsSumm.state=1

Monitor your packagers ;)

When to use: Citrix, Med-V and App-V?

2010-11-29T23:03:00.001+08:00

Microsoft and Citrix have introduced Virtual Desktop Infrastructure (VDI) which has below benefits for an enterprise-

Integrated Management
Enhanced security and compliance
Anywhere access from connected devices
Increase business continuity

The Microsoft VDI Suites can especially provide tremendous benefits for customers that want to optimize desktop deployments for the following use cases-

Contractor devices/ third-party devices: provide managed and secured desktops to unmanaged PCs.
Remote Offices with excellent connectivity: centrally manage and easily deploy desktops to multiple remote and branch offices, thereby reducing IT efforts at those locations.
Task workers: offer choice of either session-based or virtual desktops to task workers, onsite or offshore.
Regulatory compliance: VDI desktops are locked behind the datacenter, thereby inherently complying with strict regulations in industries such as financial services, government, and healthcare.

I am just in review phase and can conclude main difference between Citrix XenApp, App-V and Med-V as below-

Citrix XenApp

Specially designed for session virtualization (with remote desktop services)
Resolves application incompatibility with Windows upgrades
User profiles are created on Citrix servers and user can easily access authorised applications.
Applications need to be installed on citrix server. It does not need applications to be installed on user's machine.
Users can access applications from anywhere (thru VPN) -- I don't know if it's a benefit or limitation? benefit as it supports mobility and maintains security ; limitation as it's not supported to offline mode.
Integrated with AD to manage applications by groups.
license cost would be applicable per user
supporting limited number of sessions
not applicable to desktop/application virtualization
No specific reporting to licenses or total application usage by users.
It requires less hardware than VDI
most cost effective than VDI

Med-V

Specially designed for desktop virtualization
Resolves application incompatibility with Windows Vista or Windows 7. MED-V delivers applications in a virtual PC that runs a previous version of the operating system (for example: Windows XP).
It helps deploy, provision, control, and support the virtual environments.
It can be easily integrated with SCCM
Reporting limitations as we need to check out logs from Med-V server for each machines (during multicasting OS deployment for large organization; it's difficult to track on)
Centrally managed via a MED-V management server
It does not work on a virtualized operating system
It creates a package with a full instance of Windows
It runs two environments on a single PC
It provides a mechanism for automating the first-time setup of virtual machines at the endpoint, including assignment of a unique computer name, performing initial network setup, and joining the virtual machine to a corporate domain.
It provides central database of client activity and events facilitating monitoring and remote troubleshooting.
It provides Web browser redirection of administrator-defined domains (such as the corporate intranet or sites that require an older version of the browser) from the endpoint browser, to a browser within the virtual machine.
It offers a unique method for managing an easy to support virtual desktop environment. It takes advantage of hardware independence enabled by virtualization, and maintains the exact same image across multiple endpoints. All user changes to applications or the OS are discarded once the virtual PC session ends, and the virtual machine reverts to the original image, as packaged and delivered by the administrator. This can significantly simplify management, support, and troubleshooting for virtual machines. Updates, patches, new applications, and settings changes are applied to the master virtual image, tested by the administrator, and uploaded as a new version of the virtual image to the MED-V image repository. The new version is delivered to all endpoints using Trim Transfer technology, removing the need to update each endpoint separately.
MED-V provides a first-time customization process for every deployed virtual image, where the administrator can choose to join the virtual machine to an Active Directory domain. This way, administrators can patch, update, deliver applications, and apply policies using existing tools.
It supports offline mode (Offline work permissions may be limited by the administrator to a predefined period of time, after which the user must reconnect to the management server and re-authenticate. This ensures users are kept up to date with the most recent policy and permissions, and enforces expiration and de-provisioning settings on end users).
It maintains high availability (MED-V client operates independently of MED-V servers. If the management server is malfunctioning or has stopped responding, all clients already running a MED-V workspace may continue working. New attempts to start a MED-V workspace will run in offline mode. Only online authentication, policy changes, and image updates are unavailable, and client events are aggregated at the client side until the server is available again).

Note: there's alot features available in Med-V which are binding me to love it and apply it to production, Thanks to Microsoft for adding values... :-)

App-V

Specially designed for Application virtualization
Ability to sequence true 64-bit applications
Multiple delivery options including dynamic streaming
policy based application management including microsoft group policy
It creates a package of single application and isolates from all other applications
It resolves conflicts between applications and reduce testing
It simplifies application delivery (eliminate install)
Interoperable with SCCM
Applications do not get installed or alter OS
Applications are virtualized per instance (incl system files, registry, fonts, .ini, com/dcom objects, services, namespaces,etc)
Multiple versions of same apps can be deployed together without fear of conflict
Virtual apps do not permanently occupy HD space if you reset them after use
some applications can not be sequenced; i.e Microsoft Office, Adobe Acrobat Standard/Pro.
Some apps should not be sequenced; i.e. CS3 and AutoCAD
All workstations should have App-V clients.

Finally, I can reliable on Med-V until some more additions come to App-V.

Thanks :)

Troubleshooting Tips: Non SCCM & Unhealthy Client Machines

2010-11-26T16:46:00.000+08:00

Troubleshooting Tips: Non SCCM & Unhealthy Client Machines

Sometimes the most challenging part of the Configuration Manager 2007/SMS 2003 deployment phase can be ensuring that the client successfully reports to the site server. We occasionally see these issues here in support, typically either as cases for clients not reporting after the client installation, or maybe where it’s noticed that the client count is decreasing from the collection.

When we look at the SMS/SCCM console collection, there is an entry for the client status that indicates either Yes or No. Assuming everything is installed and configured properly, a client installed on a system should automatically report as Yes, but sometimes that does not turn out to be the case. The reason could be that the client has not yet reported to the SCCM\SMS server, or it was reporting previously but has now stopped. Managing the client in the collection is a continuous task and for a healthy environment the client should be continuously reporting to the SMS\SCCM server.

There are various reasons why a client may not be able to report to even if the SMS\SCCM agent is installed on a machine. A few of these reasons are discussed below:

The first thing to check is whether the client is on the network, and if it’s not on the network, does the system even exist? It’s possible that represents a stale record from AD.

Systems NOT on the network: If the system is not actually on the network, check if it is shutdown, and if so if it’s been shut down for long time. If yes then first restart the system and then initiate the discovery cycle from the control panel agent properties action TAB.

Stale Entries: When you use AD discovery, the DDRs are created for the computers that reside in the AD container that we have requested to be queried by the discovery process. If that container has the stale records for the resources, then client records may be created for systems that don’t actually exist, thus they will never report.

There is a Maintenance task that will clear the inactive records but if the discovery process runs again and the AD container still has these entries then they will simply show up again.

Resolution: For the stale records you need to make sure that the AD container is cleared of these stale records and scavenging is done for the computers container in AD regularly. Once this is done you can either make use of the maintenance task or you can create a collection for the NON SMS CLIENTS and then do a delete special to the collection so that the entries will be removed permanently from the SMS\SCCM database. Then a discovery can be run which will bring back only the active systems in the collection.

Once the agent is available on the network and the client is installed, the client goes through the following actions as part of the reporting process:

1. Client location services identify the site code and the MP it is supposed to connect to.

2. The client connects to the Management Point and downloads the policies.

3. Once the policies are downloaded it sends the heartbeat record to the server.

4. Once the server receives this heartbeat record these are converted in to DDR and processed. This will set the client flag to 1 which will make the client status display as Yes in the console.

5. On a regular basis the agent will send the heartbeat and if no heart beat or inventory shows up for a length of time then the client flag will be marked as 0 by the client flag maintenance task, setting the client status to No.

So only if this process is completed and it continues to happen will the client remain reporting to the server. This is why I said earlier that client management is a continuous task. There can be a variety of reasons why this process might fail, and I’ve outlined a couple of them below:

The Boundaries of the Agent are not specified in the site server

If the client is not assigned in the console or the client is unable to discover the site code, make sure that the AD site or the IP subnet is added in the boundary list. The server will only allow those clients within its boundary to download the policies, so if you have not specified the boundaries the client will not be authorized and the policies will not get downloaded. For boundary issues you can use this as a reference:

In the client if you check the location services.log (log location: C:\Windows\System32\CCM\Logs), you can get the information of the site assigned to it as well as the MP it is reporting to. If it is not able to report properly, you need to make sure that the agent can communicate over the network to the site server successfully.

Unable to get the site code

If the client is not able to get the site code, you need to check first the boundaries as above, and also verify that the site information is published in the AD. You can check the last part of the sitecomp.log after you start the site component manager which will say that the components like the MP, SLP etc successfully published or updated. If you are unable to see that and you get access denied errors, make sure that the computer account has read\write permission to the system container in AD. Make sure the permission is flowing to the objects within and the objects below. If you are not publishing the information in AD then you need to make sure that the SLP is configured and working.

The client itself is not installed in the Agent

To confirm this, try checking ccmexec.log file from client machine or check ccm.log from server end.

Make a list if you find any of these issues-

1. Newly discovered client computers are not assigned to the current site

2. Advanced Client Push Installation is not enabled at the appropriate site

3. The SMS Client Configuration Manager cannot connect to the client Admin$ share or to the Remote Registry Service (IPC$)

4. The SMS Advanced Client Push Installation account is configured incorrectly or is missing or is locked out

5. The SMS Advanced Client cannot access the installation file on the SMS site server

6. The SMS Advanced Client cannot access the management point during an upgrade

7. The SMS Advanced Client displays a site assignment but does not appear as installed

8. The Client computer appears in collections with the following values:

Site Code Client Assigned Client Type

This occurs when one or more of the following conditions are true:

a) The collection information has not been updated. Collection updates usually run on a daily or weekly schedule. In this case, you must make sure that the collection information has been updated. You can manually update the collection membership, and then update the collection view.

b) The client computer shares the same SMSID with another client computer. This issue can occur when you use a disk image to install the SMS Advanced Client. Duplicate SMSIDs are also referred to as duplicate GUIDs. You must determine whether duplicate SMSIDs exist on the client computers. For more information about how to detect duplicate GUIDs and how to use Tranguid.exe to create a New SMS GUID for the affected clients.

c) The SMS Advanced Client is assigned. However, the SMS Advanced Client is not installed. You must verify that the SMS Advanced Client is installed successfully and is assigned to the site that you are viewing.

d) The Network Discovery method is enabled. When you use the Network Discovery method in Systems Management Server (SMS), it populates the IsClient fields in the database by using a Null value. If other discovery methods are enabled, the computer will appear in the collection as Assigned with no client installed even though the client is installed. To resolve this issue, disable the Network Discovery method. Also, verify that the Heartbeat Discovery method that is enabled by default has not been disabled. Then, wait for the specified Heartbeat Discovery polling interval to pass. When the clients send up new discovery data, the database is updated to reflect the correct values.

Note Only the Heartbeat Discovery method will set the client installation status to Yes. The Active Directory System discovery method does not update the IsClient field in the SMS database.

e) Heartbeat Discovery has not reported since the client was installed.

There is a name resolution issue in the Client.

Make sure that the client is able to communicate to the SMS\SCCM server using the FQDN as well as the NetBIOS name. Use Nslookup or ping to check the name resolution. If you can’t ping the server using the FQDN then you will have problems.

The client is behind a firewall

If clients are behind a firewall, it may be restricting it from contacting the SMS site server. Check if the necessary ports are opened.

MP not working as a result of which the policies are not getting downloaded

You first need to check to see whether the MP is working. For that you will need to check the mpcontol .log (Log location: \SMS\logs in SMS and \program files\Microsoft Configuration Manager\logs in SCCM). If it is showing a 200 OK status code then that means the MP is working.

If the MP is working fine and the client is unable to contact and download polices, you will have an error on download in the policyagent.log file on the agent (Log location: C:\Windows\System32\CCM\Logs). Before checking this though, check if the locationservices.log has the correct MP information. If it does have the correct MP information, make sure that the BITS service is started on the client. You can try the following URLs to verify that this is working:

http:///sms_mp/.sms_aut?mplist

and

http:///sms_mp/.sms_aut?mpcert

Client is unable to download policy

You may also have issues downloading policies if the client agent has WMI corruption. If you suspect this to be the cause of your issue, if it is a XP client then follow these steps:

1. Uninstall SCCM client agent. Use the ccmsetup.exe /uninstall

2. Troubleshoot or rebuild WMI.

When to rebuild WMI : SCCM Client is not able to install on machines.

When to repair WMI : SCCM Client is installed on machines but inventory data is not reporting to SCCM database.

3. Restart the system and install the agent.
Server unable to process DDR

Once you find that the client is able to send the heartbeat data to the server, you next need to check on the server to see if these are getting processed successfully.

Clients going to NO after it had reported

1. The first reason for this is that the heartbeat discovery is enabled and that the DDRs are not reaching the server.

2. The second is that Clear Install Flag is running.

Solution: Initiate Discovery data collection cycle manually from client and update collection after few minutes.

Thanks.

Dynamic collection query to get machines in which specific advertisement has been failed

2010-11-24T23:22:00.000+08:00

This dynamic query will help admin to list out machines in which specific advertisement has been failed and he can readvert it to dynamic collection.

SMS_R_SYSTEM.ResourceID not in (select

SMS_ClientAdvertismentStatus.ResourceID from
SMS_ClientAdvertisementStatus where
SMS_ClientAdvertisementStatus.AdvertisementID = "ADVxxxxx" and
SMS_ClientAdvertisementStatus.laststatusmessageID in (10009))

pls specify respective advertisement id to the query.

Client installed but showing as 'No' to SCCM console - troubleshooting tips

2010-11-24T23:04:00.000+08:00

It generally happens during upgrade or restructuring of SMS/SCCM infrastructure. Anyway, if it happens with you, try below steps-

1. list out all these clients or make collection of these clients
2. run script to trigger discovery data collection cycle on listed machines or use right click tools to initiate discovery data collection cycle on machines listed in collection
3. once you have finished with above two actions, try update collection membership and refersh then.
4. Check status and make yourself happy.

Pls find link to download right click tools.
http://myitforum.com/cs2/blogs/rhouchins/0401ConfigMgrTools.zip

and here's script to initiate discovery data collection cycle on affected clients-

'copy below code to notepad and save it as discovery.vbs
'and run remotely on clients with help of psexec.exe utility

actionNameToRun = "Discovery Data Collection Cycle"

Dim controlPanelAppletManager
Set controlPanelAppletManager = CreateObject("CPApplet.CPAppletMgr")
Dim clientActions
Set clientActions = controlPanelAppletManager.GetClientActions()
Dim clientAction
For Each clientAction In clientActions
If clientAction.Name = actionNameToRun Then
clientAction.PerformAction
End If
Next
wscript.echo "Executed: " & actionNameToRun ' if you want to get message

these are some more actions which can be used in above script as and when required-

'Software Metering Usage Report Cycle

'Request & Evaluate Machine Policy
'Updates Source Scan Cycle
'Request & Evaluate User Policy
'Hardware Inventory Collection Cycle
'Software Inventory Collection Cycle
'Software Updates Assignments Evaluation Cycle
'Peer DP Maintenance Task
'Machine Policy Retrieval & Evaluation Cycle
'MSI Product Source Update Cycle

Happy troubleshooting!

Packages stucked to copy on DP: 'Install Pending'

2010-11-24T22:14:00.002+08:00

There might be different scenarios so apply fix as per need-

1. Packages are not copied to DP due to lack of permissions, pls check the necessary rights.
2. Check for package on affected DP whether it's present or not.
3. If not, check distmgr.log file on affected DP and manually copy .pck file from primary server to affected DPs and use PreloadPkgOnSite.exe tool to replicate package information to SCCM database.
here's info regarding this tool-
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=C36FCDA8-9336-4D44-9568-5530FF7635DD&amp%3Bdisplaylang=en
4. If package is present on DP but not updated to database or SCCM console; refresh DP again.
5. If still DPs not updated, try run these queries for affected DPs through central server-

update pkgstatus set Status = 2 where id = ' ' and sitecode = ' ' and type = 1

update pkgstatus set SourceVersion = 0 where id = ' ' and sitecode = ' ' and type = 1

6. After running above queries, refresh DPs again.

Happy troubleshooting!

SQL query to get patch compliance reports

2010-11-24T20:48:00.001+08:00

SELECT DISTINCT
ps.Bulletin AS Bulletin_No,
ps.Retrying + ps.PreSuccess + ps.Uninstalled + ps.PendReboot + ps.Verified + ps.NoStatus + ps.Failed - ps.Verified AS Unpatched,
ps.Retrying + ps.PreSuccess + ps.Uninstalled + ps.PendReboot + ps.Verified + ps.NoStatus + ps.Failed AS 'Total with Status',
ROUND((100 * (ps.Verified + .00000001)) / (.00000001 + ps.Retrying + ps.PreSuccess + ps.Uninstalled + ps.PendReboot + ps.Verified + ps.NoStatus + ps.Failed), 0) AS '% Compliant',
ps.Verified, ps.NoStatus, ps.Retrying, ps.PreSuccess, ps.Uninstalled, ps.PendReboot, ps.Failed, real_total.total, ps.CollectionID
FROM (
SELECT fcm.CollectionID,
pse.ID AS Bulletin,
SUM(CASE WHEN pse.LastStateName = 'No Status' THEN 1 ELSE 0 END) AS NoStatus,
SUM(CASE WHEN pse.LastStateName = 'Install Verified' THEN 1 ELSE 0 END) / 2 AS Verified,
SUM(CASE WHEN pse.LastStateName = 'Retrying' THEN 1 ELSE 0 END) AS Retrying,
SUM(CASE WHEN pse.LastStateName = 'Preliminary Success' THEN 1 ELSE 0 END) AS PreSuccess,
SUM(CASE WHEN pse.LastStateName = 'Uninstalled' THEN 1 ELSE 0 END) AS Uninstalled,
SUM(CASE WHEN pse.LastStateName = 'Reboot pending' THEN 1 ELSE 0 END) AS PendReboot,
SUM(CASE WHEN pse.LastStateName = 'Failed' THEN 1 ELSE 0 END) AS Failed
FROM
v_ApplicableUpdatesSummaryEx INNER JOIN
v_GS_PatchStatusEx pse ON v_ApplicableUpdatesSummaryEx.UpdateID = pse.UpdateID RIGHT OUTER JOIN
v_FullCollectionMembership fcm ON pse.ResourceID = fcm.ResourceID
WHERE
(pse.QNumbers NOT LIKE 'None')
AND (pse.ID NOT LIKE 'None')
AND (fcm.CollectionID = 'SMS000ES' )
GROUP BY pse.ID
, v_ApplicableUpdatesSummaryEx.Type
, fcm.CollectionID
HAVING
(v_ApplicableUpdatesSummaryEx.Type = 'Microsoft Update')) ps
INNER JOIN
(
SELECT DISTINCT ID0
FROM v_GS_PATCHSTATEEX
WHERE (Language0 = 'English' Or LocaleID0 In ('0','9'))
AND ID0 <> 'none'
AND Type0 = 'Microsoft Update'
AND Severity0 = '10') As PatchList
ON ps.Bulletin = PatchList.ID0
CROSS JOIN
(SELECT CollectionID, COUNT(ResourceID) AS total
FROM v_FullCollectionMembership
GROUP BY CollectionID
HAVING (CollectionID = 'SMS000ES' )) real_total
ORDER BY ps.Bulletin DESC

-- specify collectionID to get respective compliance rate

Thanks!

SQL query to get patch summary report for specific collection

2010-11-24T20:45:00.000+08:00

declare @Total int, /* total count collection membership */

@SMSInstall int, /* count installed by SMS */
@OtherInstall int, /* count installed externally */
@Missing int, /* count missing patch */
@NotRequired int, /* count not requiring patch */
@Required int, /* count requiring patch */
@Outstanding int /* count outstanding */
/* count non-obsolete clients */
select @Total=count(*)
from v_FullCollectionMembership fcm
join v_R_System sys on fcm.ResourceID=sys.ResourceID
where IsNull(sys.Obsolete0,0)=0 and sys.Client0=1
and fcm.CollectionID='IN000061' /* specify collectionID here */
/* patches installed by SMS */
/* patches installed by others */
/* patches required by systems */
/* v_GS_PatchStatusEx already filters out obsolete clients */
select @SMSInstall=count(distinct case
when ps1.LastState is not null and ps1.AgentInstallDate is not null and ps1.LastState=105 then ps1.ResourceID
when ps1.LastState is null and ps2.AgentInstallDate is not null and ps2.LastState=105 then ps2.ResourceID
else null end),
@OtherInstall=count(distinct case
when ps1.LastState is not null and ps1.AgentInstallDate is null and ps1.LastState=105 then ps1.ResourceID
when ps1.LastState is null and ps2.AgentInstallDate is null and ps2.LastState=105 then ps2.ResourceID
else null end),
@Missing=count(distinct case
when ps1.LastState is not null and ps1.LastState!=105 then ps1.ResourceID
when ps1.LastState is null and ps2.LastState is not null and ps2.LastState!=105 then ps2.ResourceID
else null end),
@Required=count(distinct case
when ps1.ResourceID is null then ps2.ResourceID else ps1.ResourceID end)
from (select LastState, AgentInstallDate, ResourceID, UpdateID
from v_GS_PatchStatusEx
where ID='ms08-067' and QNumbers=958644 and
UniqueUpdateID is not null) ps1
full outer join
(select LastState, AgentInstallDate, ResourceID, UpdateID
from v_GS_PatchStatusEx
where ID='ms08-067' and QNumbers=958644 and
UniqueUpdateID is null) ps2
on ps1.ResourceID=ps2.ResourceID
join v_FullCollectionMembership fcm
on (ps2.ResourceID is null and ps1.ResourceID=fcm.ResourceID) or
(ps1.ResourceID is null and ps2.ResourceID=fcm.ResourceID) or
(ps1.ResourceID=fcm.ResourceID and ps2.ResourceID=fcm.ResourceID)
where fcm.CollectionID='IN000061'
/* not requiring patch */
select @NotRequired=count(distinct fcm.ResourceID)
from v_FullCollectionMembership fcm
join v_R_System sys on fcm.ResourceID=sys.ResourceID
join v_GS_SCANPACKAGEVERSION spv on fcm.ResourceID=spv.ResourceID
join (select upkg.PackageID, max(upkg.PackageVersion) as PackageVersion
from v_ApplicableUpdatesSummaryEx us
join v_UpdatePrograms upkg on us.UpdateID=upkg.UpdateID
where us.ID='ms08-067' and us.QNumbers=958644 and upkg.PackageType=1
group by upkg.PackageID) updpkg
on spv.PackageID0=updpkg.PackageID and spv.PackageVer0>=updpkg.PackageVersion
left join (select ResourceID
from v_GS_PatchStatusEx
where ID='MS08-067' and QNumbers=958644) ps
on fcm.ResourceID=ps.ResourceID
where fcm.CollectionID='IN000061' and
ps.ResourceID is null and IsNull(sys.Obsolete0,0)=0 and sys.Client0=1
/* outstanding computers */
Select @Outstanding=@Total-(@NotRequired+@Required)
select @Total as 'Computers in collection'
select @Required as 'Computers requiring update', 100*@Required/@Total as '% of Total'
select @SMSInstall as 'Computers updated by SMS', 100*@SMSInstall/@Total as '% of Total'
select @OtherInstall as 'Computers updated by external means', 100*@OtherInstall/@Total as '% of Total'
select @SMSInstall+@OtherInstall as 'Total computers updated', 100*(@SMSInstall+@OtherInstall)/@Total as '% of Total'
select @Missing as 'Computers missing update', 100*@Missing/@Total as '% of Total'
select @NotRequired as 'Computers not requiring update', 100*@NotRequired/@Total as '% of Total'
select @Outstanding as 'Outstanding computers', 100*@Outstanding/@Total as '% of Total'

--outstanding computers are the computers that have not ran that scan yet to know if they need the patch.

--Outstanding=@Total-(@NotRequired+@Required)

SQL query to get patch status report of production servers

2010-11-24T20:32:00.000+08:00

-- It provides information about servers and their patch status as per MS bulletin ID and Qnumber.

select distinct a.name0,a.user_name0,b.id0,b.qnumbers0,
b.language0,b.product0,b.reboottype0,b.scanagent0,
'b.severity0' = Case
When b.severity0 = 10 Then 'Red'
When b.severity0 = 8 Then 'Amber'
When b.severity0 = 6 Then 'Green'
else ' '
End,
b.status0,b.type0,b.title0,b.timeapplied0,b.timeauthorized0
from v_r_system a,v_GS_PATCHSTATEEX b
where a.resourceid=b.resourceid
and b.id0 in ('MS08-003','MS08-005','MS08-006','MS08-007','MS08-008','MS08-010',
'MS08-020','MS08-021','MS08-022','MS08-031','MS08-032','MS08-033','MS08-034','MS08-035',
'MS08-036','MS08-037','MS08-045','MS08-046','MS08-047','MS08-048','MS08-049','MS08-050',
'MS08-051','MS08-052','MS08-053','MS08-058','MS08-061','MS08-062','MS08-063','MS08-064',
'MS08-065','MS08-066','MS08-067','MS08-068','MS08-069','MS09-001')
and b.qnumbers0 not in ('951746','955069','954459','954606')
and status0 like 'Applicable'
and a.operating_system_name_and0 like '%server%'

-- bulletinid and qnumbers are provided by server team. I pulled reports of servers which required these patches as per requirements.

Hope, It will help you to someway!

SQL query to get computer names which do NOT have specific file installed

2010-11-24T20:26:00.001+08:00

-- It returns all computer names which do NOT have specific file installed:
SELECT DISTINCT Netbios_Name0
FROM v_R_System
WHERE Netbios_Name0 NOT IN
(SELECT DISTINCT v_R_System.Netbios_Name0
FROM v_R_System INNER JOIN v_GS_SoftwareFile
ON (v_GS_SoftwareFile.ResourceID = v_R_System.ResourceId)
WHERE v_GS_SoftwareFile.FileName = 'filename.exe')
ORDER by Netbios_Name0

Query to get machines with specific exe

2010-11-24T20:23:00.001+08:00

SELECT DISTINCT v_R_System.Netbios_Name0
FROM v_R_System INNER JOIN v_GS_SoftwareFile
ON (v_GS_SoftwareFile.ResourceID = v_R_System.ResourceId)
WHERE v_GS_SoftwareFile.FileName = 'Notepad.exe'

-- it returns machines with specific file name. You can change file name as per your requirements.

SQL query to get untraceable laptops information

2010-11-24T20:19:00.000+08:00

-- This query gets serial nos and retrieve information as machine name, user name and respective serial no.

SELECT a.name0, a.user_name0,
b.serialnumber0 from v_r_system a,
v_GS_PC_BIOS b where a.resourceid=b.resourceid
and b.serialnumber0 in ('x', 'y')

-- x,y are serial nos.
-- you can specify as much serial nos you want.

How App-V and SCCM Integration works? Architecture View

2010-11-24T08:54:00.001+08:00

App-V and SCCM Integration Architecture

Plan for today: SCCM Administration Tips

2010-11-24T08:33:00.000+08:00

Now onwards, I will start blogging on few SCCM Administration tips on daily basis. It would be very specific and would be helpful to all my community members.

Thanks :)

Important ports for System Center Operations Manager

2010-11-24T08:30:00.000+08:00

Name
TCP/IP Port

ACS forwarder to ACS collector
51909

Agent to Root Management Server
5723

Agent-less management
Uses RPC

Operations Console to Reporting Server
80

Operations Console to Root Management Server
5724

SQL Server 2005 (Default Instance)
1433

Web Console to Web Console server
51908, 445

What are different Software Inventory File types- .sid, .sic, .sis?

2010-08-30T14:47:00.002+08:00

Just get a chance to look over different types of software inventory files and listing their brief descriptions-

.SID - Software Inventory Delta (used during delta software inventory)
.SIC - Software Inventory Complete (used during Full software inventory)
.SIS - Software Inventory of application used for Symbian OS.

Enjoy!

New Features available in SCCM vNext

2010-08-04T01:44:00.000+08:00

SCCM v.Next provides powerful and flexible user-centric management, allowing people to be able to seamlessly access their data from virtually anywhere, across multiple device types while providing IT with unified management tools and centralized control.

Basically all SCCM.vNext site systems need to be on x64 Windows platform, and NO MORE ASP web reports, SQL Server Reporting Services only!

Minimum System Requirements:

64-bit Windows for all site servers and site roles except:
Branch DPs will run on SCCM.next client OS supported platforms
Win 2003 32-bit will be supported on file share only Standard DPs.
SQL 2008 – only 64-bit editions
Win 2008 64-bit (some may require 2k8 R2)
SQL Reporting Services is the ONLY reporting platform

Available features of SCCM vNext are as below-

1. Provide a rich application management model to capture admin intent
2. Allow the administrator to think users first
3. Provide the end user a fitting user experience to find/install software with
4. Allow the user to define their relationship to applications
5. Redesigned hierarchy and SQL Server replication
6. Automated content distribution
7. Client Health improvements and auto-remediation
8. Redesigned admin experience and role-based security model
9. Native 64-bit and full Unicode support
10. Software Updates auto-deployment (including Forefront definitions)
11. Automated settings remediation (DCM “set”)
12. Consolidated and expanded mobile device management
13. Improvements to OS Deployment and Remote Control
_____Contd..

Announcing ConfigMgr v.Next Beta 1 ICP1: TAP Nomination Open

2010-06-18T17:47:00.000+08:00

Download a copy here:
http://www.microsoft.com/systemcenter/en/us/configuration-manager/cm-vnext-beta.aspx

SCCM is supported on SQL Server 2008

2010-06-16T15:58:00.002+08:00

A clean installation of ConfigMgr RTM on SQL Server 2008 is not supported. You should upgrade instead. If you upgrade the site server database to SQL 2008 you should apply the following hotfix:
For ConfigMgr RTM - http://support.microsoft.com/kb/955229

A clean installation of ConfigMgr SP1 is supported but you should install the following hotfix:
For ConfigMgr SP1 - http://support.microsoft.com/kb/955262

what's new in OpsMgr R2?

2010-06-16T15:57:00.000+08:00

Below are the new enhanced features of OpsMgr'07 R2-

1. Extends end to end monitoring of distributed applications to any workload running on Windows, Unix and Linux platforms.

2. Maximize availability of virtual workloads with integration with System Center Virtual Machine Manager 2008.

3. Improved management of applications in the data center . Delivers on the scale requirements of URL monitoring of your business.

4. Meet agreed service levels with enhanced reporting showing application performance and availability.

5. More efficient problem identification and action to resolve issues.

6. Increased speed of access to information and functionality to drive management . Faster load times for views and results.

7. Improved and simplified management pack authoring experience The Operations Manager 2007 R2 beta integrates the functionality delivered
within the Cross Platform Extensions Beta. New betas of the Interoperability Connectors will available shortly through the Operations Manager R2 Connect program.

Timeframe Decided for ConfigMgr R3

2010-06-16T15:42:00.001+08:00

TAP Nominations Open - September 2009
Beta - January 2010
TAP Nominations close - February 2010
TAP Program commences - March 2010
RTM - December 2010

Configuration Manager 2007 R3 is coming by Q2

2010-05-03T14:07:00.002+08:00

What's New in Configuration Manager 2007 R3

The following features are new and apply only to Configuration Manager 2007 R3:
Power Management. Provides a set of tools to allow the site administrator to configure standard Windows power settings across computers
Operating System Deployment Enhancements. Prestaged Media is a way to integrate with OEM factory imaging in order to leverage imaging at the OEM to speed up new hardware deployments
Dynamic Collection Evaluation. Allows you to more rapidly evaluate a collection membership by adding only newly discovered resources.
Delta Discovery. Performs an intermediate discovery cycle adding only new resources to the Configuration Manager 2007 database.
Collections. Allows you to search for and add resources to the specified collection.
Desired Configuration Management. Allows you to easily create collection of compliant or noncompliant computers in desired configuration management.
Supported Clients Per Hierarchy. Configuration Manager 2007 R3 supports up to 300,000 clients per hierarchy when using the default settings for all Configuration Manager 2007 features. This increase in supported clients is the result of improvements to the Active Directory synchronization and Collection Evaluation processes.

Be a part of Cloud Summit – a Virtual TechDays special on Cloud Computing!

2010-03-16T18:06:00.000+08:00

Join us on Day 1 – March 17, 2010 to get in-depth insights from Microsoft Experts.
Block your calendar today for these invigorating Sessions on Cloud Computing and Virtualization.

register yourself:
http://www.virtualtechdays.com/default.aspx

ITMU Functionalities: How it works?

2010-02-19T13:58:00.001+08:00

Advertisement Begins
Check %windir%\system32\ccm\logs\execmgr.log – All advertisements executed by the SMS client are written to this log. You should be able to find the AdvertisementID for the Scan. Also, look for Requesting content from CAS for package version ## – ## should be the current package source version for the Microsoft Updates Scanner. Finally, you should see the command line used (which contains “Scanwrapper.exe”), the process created, and the Raised Program Started Event for AD: .. At this point, ScanWrapper.exe has been launched.

ScanWrapper Begins
Check %windir%\system32\ccm\logs\ScanWrapper.log – This log is generated by ScanWrapper.exe – Use the Date/Time column to find the most recent Software Updates Scan Tool Started entry. It will perform checks for Windows Update Version, Client Version, etc. ScanWrapper.log will also show the “Source Directory” and “Cache Directory” for the CAB file. ScanWrapper then launches SMSWusHandler. *Note: Scanwrapper.log is also used for other Scanning tools, such as the Extended Software Update Inventory Tool (ESUIT).

SMSWusHandler Begins
Check %windir%\system32\ccm\logs\SMSWusHandler.log – This log is generated by SMSWusHandler.exe, and is used to initiate actions on the Windows Update Agent. Use the Date/Time column to find the most recent SmsWusHandler Started entry. After performing a Windows Update version check, you will see an entry that reads similar to this: ScanPackage serviceID being used for this search is {78cc3df0-6ae3-4990-ab7c-87aeffb4b7fc}. The log will pause on this entry for a few minutes, because SMSWusHandler has handed off the scan to the Windows Update Agent.

WindowsUpdate Begins (and Completes)
Check %windir%\WindowsUpdate.log – This log is generated by the Windows Update (Automatic Updates) agent, which is used for patch scan and installation. Use the Date/Time stamp (located at the beginning of every row) to find the most recent Logging Initialized entry. Follow the log for Added Update entries. **Some entries in this log may appear as errors, but are actually “normal” – review the help link for more information.

SMSWusHandler Completes
SMSWusHandler continues after the completion of WindowsUpdate, listing each potential update, and states whether “Applicable” or “Installed”, writes the data to and .xml file in the cache directory (e.g., C:\WINNT\system32\VPCache\\Results.xml), and finishes the log with SmsWusHandler Terminating.

ScanWrapper Completes
ScanWrapper continues after the completion of SMSWusHandler, by reading the results.xml file – (e.g., Patch information from C:\WINNT\system32\VPCache\\Results.xml). The log then writes the details of each potential update, (including MS KB and security bulletin ID), and states whether the patch is applicable or installed. Next, it writes the data to Win32_PatchState_Extended. Finally, the information in Win32_ScanPackageVersion is updated, and Scanwrapper exits

Advertisement Completes
Finally, execmgr.log completes with a message similar to the following: Execution is complete for program Microsoft Security Updates. The exit code is 0, the execution status is Success.

What is Binary Differential Replication in SCCM?

2010-02-19T13:31:00.000+08:00

Binary Differential Replication, sometimes known as "delta replication," is used by Configuration Manager 2007 to update package source files with a minimum of additional network traffic.

When Configuration Manager 2007 updates the source files for a package, and the source files have already been distributed, it sends the parts of the package that have changed since the last time the package was sent (originally, as an update, or as a refresh). This minimizes the network traffic between sites, especially when the package is large and the changes are relatively small. A file is considered to be changed if it has been renamed, moved, or its contents have changed.

The originating site keeps the differences between the current version of a package and the previous five versions. If a child site or distribution point has one of the previous five versions of the package, the originating site will send the appropriate changes to that site. If the child site has an older version of the package, the originating site will send the entire package.

If the originating site sends the changed files for a package but the receiving site no longer has the package, or the package has been altered at that site, the receiving site will send a status message to the originating site reporting the problem.

Note
In order for Configuration Manager 2007 to use binary differential replication, all receiving sites must first have received at least the initial version of the package. Until all receiving sites have the initial version, Configuration Manager 2007 will not use differential replication.

Care should be taken when distributing changes to a package's source files. If the path to a receiving site is closed, it is important that you not attempt to update the distribution point multiple times before the site address is again available. Each update will include the files from the previous update because the receiving sites will not yet have the previous update. As a result, the updates will include multiple redundant files, wasting network bandwidth.

Note
The processing time for large packages can take an extended period of time (20-30 minutes in some cases or even longer, depending on the size of the package). During this package compression/decompression and hashing/signature-creating process, distmgr.log might appear to be idle, even though the process is continuing.

General SMS Console access tips

2010-02-17T12:48:00.000+08:00

If you can’t add a site server name to your SMS console try adding an entry to your machines hosts file located at C:\WINDOWS\system32\drivers\etc\hosts.

Also, it may help to add the servers’ domain to your machines list of DNS entries.

To do this on the Windows XP based computer that is running the SMS Administrator console, follow below steps:

1. Click Start, click Run, type dcomcnfg.exe, and then click OK.
2. Locate the Console root node, expand Component Services, expand Computers, and then click My Computer.
3. Right-click My Computer, and then click Properties.
4. In My Computer Properties, click the COM Security tab.
5. In Access Permission, click Edit Limits.
6. Click ANONYMOUS LOGON.
7. In Permission for ANONYMOUS LOGON, click Allow setting for Remote Access.
8. Click OK two times.
9. Restart your computer.

command to refersh SMS Policy

2010-02-16T18:56:00.000+08:00

To Request policies:
WMIC /namespace:\\root\ccm path sms_client CALL TriggerSchedule "{00000000-0000-0000-0000-000000000021}" /NOINTERACTIVE

To Evaluate(Apply) policies:
WMIC /namespace:\\root\ccm path sms_client CALL TriggerSchedule "{00000000-0000-0000-0000-000000000022}" /NOINTERACTIVE

Query to get SQL Server version and edition

2010-02-10T20:07:00.000+08:00

Pls use the below query to get the SQL server version and edition-

SELECT SERVERPROPERTY('productversion'), SERVERPROPERTY ('productlevel'), SERVERPROPERTY ('edition')

How SMS gets status report for custom MIF file?

2010-02-10T19:37:00.000+08:00

SMS looks for the MIF file to be placed in either the machines temp directory (%TEMP%) or the system root directory (%SYSTEMROOT%). SMS also ensures that the MIF file was created after the program execution was started to make sure that it does not accidentially import incorrect status information.

Once SMS finds a matching MIF file, it will parse the file and, if valid, it will transmit the data back to the SMS server. It will then delete the MIF file from the file system.

If SMS does not find a matching MIF file, then it does not delete any files (MIF or otherwise) and returns a SUCCESS value if the exit code from the executed process was 0. Any other value results in a FAILED value being returned up to the SMS server.

The status MIFs generated on the clients must be saved in either the system %temp% or %Windir% directories. %Windir% is used if the user has sufficient privileges to write to that folder; otherwise the files are placed in the %temp% folder. The preprogrammed status MIF generation tools will automatically place status MIFs in these directories. If you generate status MIFs by using other techniques, you must ensure the status MIFs are placed in these directories.

How to obtain 100 % ConfigMgr Client Installation?

2010-02-02T23:46:00.000+08:00

To ensure that all systems that are intended and targeted for the ConfigMgr client installation. The best client deployment method is using AD GPO that will apply 3 settings.

1. the ccmsetup parameters are place in the registry
2. the WSUS URL is place in the registry.
3. applies the ADM Client Assignment template.

Enable WSUS/SUP Client Installation. In the GPO add the WSUS URL for your SUP Site Role. As clients join the domain or connects to the network, the Windows Update Agent will scan against your WSUS server and the ConfigMgr client will be detected as not installed and WSUS will install the client treating the client as if it was a critical update.

The installation will start about 2 to 3 minutes after the client is detected as not installed. This method will also upgrade a client that is lower than the published version in WSUS. If a client is already installed with the right version, the client will be re-assigned to your site if not already assigned. Also as part of this GPO you will want to add the ADM Client Assignment template. This is comes with ConfigMgr 2007. This template will keep clients assigned to the site of choice.

Two things will happen automatically for you. If the client is un-installed for any reason, WSUS will re install the client on the next WSUS scan. If the client is re assigned to another site, the ADM template with automatically reassign the client back to the originating site code immediately.

sources: MyITForum.com

Daily SCCM Administrative Activities: ConfigMgr'07 Inboxes to Monitor

2010-02-02T23:37:00.000+08:00

Listed here is a list of the ConfigMgr 2007 inboxes that should be checked on a regular basis to ensure that your site(s) function as expected.

Auth\Dataldr.Box
A backlog of files can indicate problems accessing the site database.

Auth\Dataldr.Box\Process
A backlog of files can indicate problems accessing the site database.

Auth\Ddm.box\Bad_DDRs
A backlog of files can indicate a network corruption problem or a problem with the DDM

Auth\Sinv.Box
A backlog of files can indicate that the Software Inventory Processor cannot connect to the site database or that too many files were received.

Auth\Sinv.Box\Orphans
A backlog of files can indicate problems with specific clients, with management points, or with the network that could cause data corruption.

Compsumm.Box
A backlog of files can indicate that the Component Status Summarizer cannot process the volume of messages.

Dataldr.Box
A backlog of files can indicate problems accessing the Systems Management Server (SMS) database

Dataldr.Box\Badmifs
A backlog of files can indicate a bad custom MIF file or that a client computer cannot transfer the file correctly.

Ddm.Box
A backlog of files can indicate a bad DDR is preventing other DDR’s to process.

Ddm.Box\Bad_DDRs
A backlog of files can indicate a network corruption problem or a problem with the DDM

OfferSum.Box
A backlog of files can indicate a performance problem that is caused by a large number of messages.

Policypv.Box
A backlog of files in the policypv.box folder indicates that the policy provider component is not running.

Replmgr.Box\Ready
A backlog of files can indicate that the Scheduler is backlogged or is already processing files of the same priority

Schedule.Box
A backlog of files can indicate that the Sender cannot connect to or cannot transfer data to another site.

Schedule.Box\Outboxes
A backlog of .srq files indicates that the sender cannot process the number of jobs scheduled for that sender or that the sender cannot connect to or transfer data to another site.

Schedule.Box\Tosend
A backlog of files can indicate that many send requests are not completed or that the Scheduler has not yet deleted the files.

Sinv.Box
A backlog of files can indicate that the Software Inventory Processor cannot connect to the site database or that too many files were received.

Sinv.Box\BadSinv
A backlog of files can indicate problems with specific clients, with management points, or with the network, causing data corruption.

SiteStat.Box
A backlog of files can indicate a performance problem. Examine status messages for the Site System Status Summarizer for possible problems.

Statmgr.Box\Futureq
A backlog of files can indicate that some site systems' clocks are not synchronized with the site server.

Statmgr.Box\Queue
A backlog of files can indicate a problem with the Status Manager or that the component is trying to process too many messages.

Statmgr.Box\Retry
A backlog of files can indicate problems with the connection to the computer that is running SQL Server.

Statmgr.Box\Statmsgs
A backlog of files can indicate a problem with the Status Manager or that the Status Manager is trying to process too many messages

Swmproc.Box
A backlog of .sum and .sur files can indicate that the Software Metering Processor component cannot connect to the SMS database.

What is BranchCache? How SCCM supports BranchCache?

2010-02-02T00:11:00.000+08:00

Microsoft introduced a new terminology in Windows7 and Windows Server 2008 R2 called BranchCache to reduce traffic load on wide area network called BranchCache. Network enabled with BranchCache cache data in branch and subsequent request to same data is served by cached stored in WAN branch. BranchCache optimizes traffic flow between Windows Server 2008 R2 servers and BranchCache-enabled clients; Windows Server 2008 R2 servers and computers running Windows 7 can be configured as BranchCache clients.

BranchCache operates in one of two modes:

1. Distributed Cache: In Distributed Cache mode, BranchCache-enabled clients cache copies of files downloaded from content servers across the WAN and send them directly to other clients when requested. Distributed Cache mode is especially beneficial for branch offices that do not have a local server.
2. Hosted Cache: In Hosted Cache mode, a Windows Server 2008 R2 server, known as the Hosted Cache, acts as the host for the cached content. BranchCache-enabled clients cache data that they have requested and downloaded from content servers locally and use the Hosted Cache to retrieve data that is not available from their own local cache. Clients know the identity of the Hosted Cache and retrieve data from the Hosted Cache. For data not available from the Hosted Cache, the client downloads the data from the content server and offers it for caching to the Hosted Cache. Hosted Cache mode is beneficial in organizations that want to audit access to content in the local cache, or larger branch offices that have local servers.

BranchCache Hosted and Distributed cache modes
BranchCache improves the performance of applications that use one of the following protocols:

a.Hypertext Transfer Protocol (HTTP) and Hypertext Transfer Protocol Secure (HTTPS). The protocols that Web browsers and many other applications (such as Microsoft Internet Explorer®, Microsoft Windows Media Player®, and more) use.
b.Server Message Block (SMB), including signed SMB traffic. SMB is the protocol used for shared folders on Windows networks.
c.Background Intelligent Transfer Service (BITS). BITS is used to transfer files asynchronously between a client and a server. BITS is the protocol that System Center Configuration manager (SCCM) and Windows Server Update Services (WSUS) use.

Alerts that are raised by the monitors should not be manually resolved in Operations Manager 2007

2010-02-01T23:53:00.000+08:00

SCOM alerts can be raised by the monitors. Alerts that are raised by the monitors are typically the result of a state change. These alerts are displayed in the Operations console similar to the alerts that are raised by rules. However, these alerts should not be manually resolved.

Why?
Alerts that are raised by the monitors are related to a state change. These alerts should be resolved by the monitor itself. For example, the monitor waits for when the state changes back to Success or green. Alerts can be manually resolved in the Operations console. However, MS do not recommend that you manually resolve the alerts. If the alert is manually resolved, the resolved state of the alert does not match the state of the monitored object.

source: kbAlertz.com

What's new in ConfigMgr'07 R3?

2010-02-01T20:19:00.000+08:00

1. Scale & Performance Improvements: Collections in R3

a. Microsoft is focusing on evaluating new systems in R3 and will implement new collection setting called 'Fast evaluation' which populates newly discovered machines.
b. Full evaluations are still processed in the same way.
c. A new collection needs a full evaluation to show existing clients.

How it works:
- Collections are evaluated by periodically executing a query
- results are inserted into a temporary table
- this table is then merged into the master collection results table (Collection Members)
- If there is no change in results, master results table not changed
- If onlya few resources have changed, evaluation process faster due to only processing changed resources.

2. Scale & Performance Improvements: Delta AD Discovery

a. Each AD discovery query has 2 tasks:
1. Discover any changes to any users or machines, based on the query, that would likely affect targeting (default is 5 minutes)
2. Perform a periodic "full scan" to capture users and machines last logged time, ensuring active users and machines are not made obsolete.

b. On an individual query basis, select to run "discovery now" for a full scan.

3. Scale Improvements: R3 supports 3,00,000 clients when using the default settings for all ConfigMgr 2007 features.

Note: No change to other site and site role supported numbers.

4. Sharepoint based ConfigMgr dashboard
- compliance metrics related to SUM, SWD, DCM, Licensing and OSD sections for a particular time period.
- sharepoint based authentication: customize dashboards based on User Roles.

What's new in ConfigMgr'07 Service Pack 2?

2010-02-01T19:30:00.000+08:00

SCCM 2007 SP2 supports below platforms-
-Windows 7
-Windows Server 2008 R2
-Windows Vista SP2
-Windows Server 2008 SP2

New features added to SCCM 2007 SP2 are:
1. Managed Client Support - Client can be a target for apps, inventory, updates and more.

2. Site role host control - Servers can host all site infrastructure roles.

3. Improved Client Policy Evaluation -

a. Faster Policy Processing: before SP2, policy download was queued locally for 2 minutes before processing. This 2 mins delay has been removed in SP2.
b. Most efficient software distribution configured to run at user logon:
before SP2 user policy requests were not downloaded for 2 minutes after user logon event. This caused a delay is user/group targeted advertisements.
c. A common scenario is an App-V distribution environment where user/security group targeting is used.
d. this 10 mins delay has been removed in SP2 and user/group targeted advertisements are instantly available after user logon in SP2.

4. Branch cache support:
a. Integration enables configmgr organizations to
-significantly reduce WAN traffic
-reduce transfer loads on DPs.
b. Clients that are Branch Cache enabled will transfer content from peers if available before hitting DP.

5. SP2 will also continue to deliver new support for x64 architectures including:
a. x64 support for OpsMgr'07 client agent
b. Update to OpsMgr MP for x64 OS
c. x64 performance counters
d. Remote Control support added for x64 windows XP and x64 Windows Server 2003.
e. App-V x64 Client Support.

6. Asset Intelligence Certificate Requirement Removal:
ConfgMgr'07 SP1 introduced Asset Intelligence v1.5. With SP1, Asset Intelligence could be configured to use as online synchronization for updates. With SP2, the requirement to have the certificate has been removed.
-The initial release required a certificate.
Software Assurance is not required for this functionality, including SP1.

7. Intel vPro Technology: Integration Enhancements in SP2-

a. Wireless Profile Management
b. 802.1x support
c. Non volatile memory or third party data store (3PDS)
d. Access Monitor: Audit log
e. Remote Power Management: Power State Configuratio from SCCM console.

system center power management phases:
Monitor-> Plan-> Apply-> Check-> Report (saving in power consumption and costs and environmental impact)

8. OS deployment:

a. Multiselect and delete driver catalog drivers from the SCCM console
b. task sequence UI displays package names as in the SCCM console.

9. Better feedback on AD extension success/failure.

The "Windows Operating System" column has a "Not monitored" state for a new agent

2010-02-01T15:24:00.000+08:00

Reason: This issue occurs because the new agent has the same NetBIOS name as a previously installed agent. When the agent is deleted from Operations Manager, the grooming of the deleted agent is hard coded to occur after two days. Therefore, the agent is not immediately groomed out of the database completely.

Solution: To work around this issue after the agent was deleted from the console, wait three days, and then add the new agent to Operations Manager. Or, make sure that two full days have passed, and then add the new agent to Operations Manager.

What is package sending priority: Advertisement Properties

2010-02-01T00:19:00.000+08:00

Sending priority
The priority of this package when sent to distribution points in child sites. Packages can be sent with High, Medium, or Low priority. The default setting is Medium priority. If a package has High priority, it will be sent before packages with Medium or Low priority. If a package has Low priority, it will be sent after packages with higher priority settings.

Note: A Package will be sent in the order in which they were created in the SMS Administrator console.

What is Package processing thread in distmgr.log file?

2010-01-31T23:37:00.001+08:00

When I was troubleshooting the copy package issue as mentioned in my earlier post, I got some some messages "package processing thread in queue".

I started to find out the exact meaning of this and found that the threads are used for copying packages to distribution points. If we distribute more packages at one time than the number of threads then the package will be putting on queue. The retry count is used when a copy fails.

Note: In legacy version of SMS (without SPs), the number of distribution points that could be effectively managed by a site server is small because SMS allocates a single thread per package. This results in SMS copying content to one particular distribution point, and when successful, moving to the next distribution point.
From SMS 2003 SP1, it copies content to multiple DPs in parallel. Because of this change, the failure of a single DP does not halt software distribution. This change improves both reliability and response time for package deployment, and effectively allows a single site to support a much larger number of distribution points.

The following improvements and benefits have resulted from this change:

1. Less time for package distribution to all DPs of the site
2. A single site can support more distribution points
3. Site hierarchy can be simplified to replace some secondary sites with distribution points in some of scenarios.
4. Faster Software and Patch distribution.
5.Lower hierarchy deployment costs, which results in fewer site servers

Lower maintenance costs, because it is easier to manage a distribution point than a site

Failed to hash file, Win32 error = 64: Package not copying to DP

2010-01-29T20:12:00.000+08:00

I got this error on one of my DP while I was trying to copy package on all the DPs.
I checked the distmgr.log file from the primary server from where i was copying it to the DPs and got the error.

As a resolution step, I removed package from that DP and copy it again.

It worked well.

Why MS integrated SQL Reporting Service with Configuration Manager 2007 R2?

2010-01-27T20:00:00.000+08:00

With Configuration Manager 2007 R2, a new site role called "Reporting Services Point" was introduced that facilitates reporting using SQL Reporting Services 2005/2008. This is accomplished via a conversion wizard that ships with Configuration Manager 2007 R2 and allows the user to convert all the Configuration Manager reports that currently exist on that site server to SQL Reporting Services based reports and deploy them to the SQL Reporting Server.

Site Role Installation and Configuration

The following outlines the overall workflow in getting a SQL Reporting Services based reporting point up and running:

1.Pre-requisites: Any machine having a valid SQL Reporting Server 2005/2008 instance running on it.
2.Run the site role wizard and install the "Reporting Services Point" on the SQL Reporting Server. The site role wizard asks for a root folder name which is basically the folder on the reporting server under which all the reports will be deployed.
3.Once the site role wizard is completed successfully, you should see the server appearing under the Reporting Services node under the Reporting node in the administration console.
4.Right click on the server and launch the "Copy Reports Wizard"
5.Run through the "Copy Reports Wizard" and select all the reports that you want to convert to SQL Reporting Services based reports.
6.The wizard will then go through the selected reports, convert them into SQL Reporting Services based reports and deploy them to the reporting server under the folder specified in step 2. above.
7.The copy reports wizard groups all the reports based on report categories creates a folder for each report category and deploys the reports under the respective report category folder.
8.Once all the reports are deployed, you can see all the report folders in the administration console and run any of the reports from any of the folders. You have the option of running the reports from within the administration console or run the reports directly from SQL Reporting Services using the SQL Report Manager (web UI). The SQL Reporting server report manager URL has the following naming convention:
For the default SQL Reporting Server instance the URL to access the report and report folders would be:

http://[ReportServer]/Reports

For named SQL Reporting server instances the URL would be:

http://[ReportServer]/Reports_[InstanceName]

Other functionalities provided within the Configuration Manager administration console

1.Report subscription wizards to create subscriptions for any of the Configuration Manager reports

2.Report authoring tools:

Model based report wizard
The Configuration Manager 2007 R2 release ships two out-of-the-box report models one for Client Health Reporting and the other for Software Updates Management. The model based report wizard facilitates users to create custom reports using these report models.

SQL Based report wizard
The SQL based report wizard facilitates SQL savvy users to specify SQL queries and generate reports off of these queries. The wizard presents the users with a list of all available Configuration Manager database views and the corresponding columns to facilitate users to formulate SQL queries more easily and make the process less prone to errors and typos.

What are the benefits of SQL reporting services in SCCM?

2010-01-27T19:57:00.000+08:00

Benefits of using SQL Reporting Services:

1.Ability to export reports to any other formats like Word, Excel, PDF etc.
2.Ability to create report subscriptions that can be scheduled to run at specific times and send out reports to interested people. A good user scenario around this would be to create a report subscription for the Software Updates reports and schedule them to run late on Tuesday night or early Wednesday morning after all the "patch Tuesday" updates are applied to all systems.
3.Report authoring experience is very much enhanced with the tools that come with SQL Reporting Services like SQL Report Designer. You could either create report models or create SQL-based reports and run them off of the SQL Reporting Server.
4.Timeouts can be configured on a per-report basis depending on which reports potentially return large amounts of data.
5.Since the reports are standard SQL Reporting Services reports, they can be easily imported and exported from one SQL Reporting server to another.
6.A common request from customers is to be able to run reports off of a Configuration Manager database replica before enabling them on the production environment. This is a gem of a functionality that can be easily accomplished by simply making the data source for the reports point to any valid Configuration Manager database; in this case point the data source of the reports to the database replica and once they have been verified just change the data source to point to the actual production database. This proves to be very useful for benchmarking environments.
7.Report branding is another frequently requested functionality by many customers. This commonly entails customizing the look and feel of reports by changing fonts, font sizes, custom logos etc. With the ability to create custom reports using SQL Reporting Services, customers can now apply their own report branding to the reports.
8.SQL Reporting Services provides the functionality to enable report caching to facilitate lower execution times on subsequent report execution requests. The cache timeout value can be configured appropriately depending on how often you expect the report data to change.
9.Report snapshots that are an alternative to report caching and can be scheduled to execute at specific times. When you select a report snapshot for viewing, the report server retrieves the stored report from the report server database, and shows the data and layout that were current for the report at the time the snapshot was created.

SCCM Reports: Useful Microsoft links

2010-01-27T19:45:00.000+08:00

Below are the Microsoft links which helps to understand SCCM reports.

Reports home page: http://technet.microsoft.com/en-us/library/bb632942.aspx

How to manage reports: http://technet.microsoft.com/en-us/library/bb632699.aspx

Technical reference for reporting: http://technet.microsoft.com/en-us/library/bb694105.aspx

What is difference between Obsolete and Inactive Clients?

2010-01-26T00:40:00.000+08:00

I had to understand the difference as it was asked by the management and every administrator should know it.

Obsolete Clients
When the SMS server finds that the client hardware ID has been updated or superseded by another machine and if multiple records are in place having the same hardware ID value for the machine, the older records are marked as obsolete.

Inactive Clients
When the client health monitoring tool determines that the client failed its checks and finds that the client is either not in a healthy state or is no longer on the network. These clients are known as inactive clients.

Note: While I was trying to figure out why the some of the machines come under no status or waiting state, the above difference has helped me a lot.
I am putting some scenario here-

I have 100% healthy sms clients in the company's infrastructure and perform the activities like deleting obsolete clients, removing AD stale objects on daily basis. Inspite of this, I used to get some machines in "no status" and "waiting" category.
The reasons, I figured out, were:
offline machines/no name resolution machines were in "waiting" category and machines which were in IT stock or were inactive for a period of time, listed under "no status" category.

Reasons to malfunctioning of SMS/SCCM Clients

2010-01-22T14:49:00.000+08:00

SMS Client Malfunctioning: Possible reasons

1. Machines are not in network.
2. AD Stale Objects
3. Machines not coming under the specified site boundaries
4. Site Code Not Assigned to the machines properly
5. Name Resolution Issue
6. Firewall restrictions: Relevant Ports used by SMS/SCCM should be opened
7. Machines with duplicate GUIDs
8. Policies are not getting downloaded from MP (Management Point)
9. Management Point not functioning well
10. The SMS Client Configuration Manager cannot connect to the client Admin$ share or to the Remote Registry Service (IPC$)
11. The SMS Advanced Client Push Installation account is configured incorrectly or is missing or is locked out
12. Advanced Client Push Installation is not enabled at the appropriate site
13. Newly discovered client computers are not assigned to the current site
14. The SMS Advanced Client Network Access Account is configured incorrectly or is missing or is locked out in a non-Active Directory environment
15. The SMS Advanced Client cannot access the installation file on the SMS site server
16. Clear Install Flag is running: As a result, sms client will reported as NO.

Discovery Methods do what?

2010-01-22T00:54:00.002+08:00

1. Heartbeat discovery
It pings all the machines existing in the network, i.e domain and workstation group machines are discovered automatically and shown under "All Systems" collection. If we enable Heartbeat Discovery, the discovery data is refreshed on a schedule that you determine. If we disable Heartbeat Discovery, the discovery data is refreshed only when another discovery method is invoked or run on a schedule.

2. Windows User Account Discovery and
It discovers all user accounts in same domain.

3. Windows User Group Discovery
Windows User Group Discovery is useful for creating group-based collections for software distribution

4. Network Discovery
Network Discovery discovers the client operating system only if the computer is configured to share resources. It discovers the following-
Topology
Topology and client
Topology, client, and client operating system

5. Active Directory User Discovery
It discovers the following:
User name
Unique user name (includes domain name)
Active Directory domain
Active Directory container name
User groups (except empty groups)

Note: We should run Active Directory User Discovery only on primary sites.

6. Active Directory System Discovery
It discovers the following:
Computer name
Active Directory container name
IP address
Assigned Active Directory site

Note: Polling performed by Active Directory System Discovery can generate significant network traffic (approximately 5 KB per client computer).

7. Active Directory Security Group Discovery
It discovers the following:
Domain Local Security groups
Domain Global Security groups
Universal Security groups

Note: We can run Active Directory Security Group Discovery only on primary sites. It polls Active Directory for all system resources in its database, including those discovered at child sites, and including secondary sites. Because Active Directory Security Group Discovery does not contact the computers directly, the computers do not have to be turned on to be discovered.

8. Active Directory System Group Discovery
It discovers the following:
Organizational units
Global groups
Universal groups
Nested groups
Non-security groups

Note: We can run Active Directory System Group Discovery only on primary sites. It polls Active Directory for all system resources in its database, including those discovered at child sites, and including secondary sites. Because Active Directory System Group Discovery does not contact the computers directly, the computers do not have to be turned on to be discovered.

How to Manage Obsolete Clients?

2010-01-21T17:48:00.000+08:00

If you want to get accurate deployment success rate(%), it's required to manage obsolete client on daily basis.

What I do normally:
Open SMS Administrator Console-> Expand Site Hierarchy-> Expand Site Settings->Expand Site Manitenance-> Select tasks-> open "Delete obsolete Client Discovery data" properties and enable it.

You need to delete data older than 1 days.

After that click on the "All Systems" collection and check whether any client still shows as obsolete. You can delete those client from the console itself.

Note: During the deployment, package can be targeted to non obsolete clients only.

Troubleshooting Management Point Issue : Steps to be taken

2010-01-21T17:38:00.001+08:00

MP Issues Desription:
Failed to send http request /SMS_MP/.sms_aut?MPLIST. Error 12029 SMS_MP_CONTROL_MANAGER 1/11/2010 4:51:40 PM 3924 (0x0F54)

Http verification .sms_aut (port 80) failed with no header received SMS_MP_CONTROL_MANAGER 1/11/2010 4:51:40 PM 3924 (0x0F54)

How to Handle:
Within IIS, a virtual directory is added under the default website during the Management Pointinstallation. The virtual directory is called “SMS_MP” (without the quotes). This virtual directoryis how the advanced clients are able to communicate with the MP and ultimately via theISAPI’s convert the data transmitted to the MP to files and information for insertion into the SMS database.

Need to mention that the MPControl is a self-checking component of the Management Point. In case it’s giving error messages first you need to check if the functionality is working at all.

A good test would be to check if a given client talking to that MP can send up HW inventory (you can check in resource explorer) AND if the client can get policy (policy spy on the client)

In order to send a Full HW Inventory you need to fire this vbs on the client and the trigger a HW Inventory cycle

Dim oLocator
Set oLocator = CreateObject("WbemScripting.SWbemLocator")
Dim oServices
Set oServices = oLocator.ConnectServer( , "root\ccm\invagt")
' Delete the specified InventoryActionStatus instance
x = "{00000000-0000-0000-0000-000000000001}"
oServices.Delete "InventoryActionStatus.InventoryActionID=""" & x & """"

If the functionality is ok, most likely only the self tests are wrong. In this case you need to check with the MP troubleshooter or with the URL’s. The cause could most likely be network related

If the functionality is wrong we need to check
IIS (Does WWW run? IISRESET)
IIS permissions (clients have anonymous access? Is the IUSR and the IWAM account locked?)

DCOM
The SMS Management Point and SMS Agent Host service consist of several COM objects. TheSMS Agent Host service usually runs under the context of LocalSystem, so increased DCOMsecurity does not often cause a problem for the Advanced Client. The SMS Management Point, however, runs under the identity of the IWAM account, so any additional restrictions on DCOMsecurity can prevent the MP from functioning. If the MP does not start under the IWAM identitiy, but uses either a copy of this account or an entirely new account, then default permissions may not be enough to start the MP.

SQL (Has the MP account a “clear way” through the OS and SQL permissions to the SQL tables? Use SMS groups on the site servers!!)

Status Message Codes in IIS
If the client’s request does appear in the web service log, the next field to look for is the status code. The three digit return code of an http request will consist of two parts. The first digit will indicate the general status.

General Status Codes in IIS
First Digit General Status
2xx Success
3xx Redirection
4xx Client Error
5xx Server Error
The second two digits will give a more descriptive explanation of the status. In some
instances, such as a 401 or 403 error code, there will be a sub code, such as 401.1 or 403.4
A complete list of IIS status codes can be found in the following article:

294807, “HOW TO: Turn Off the Internet Explorer 5.x and 6.x "Show Friendly HTTP Error
Messages" Feature on the Server Side”
http://support.microsoft.com/default.aspx?scid=KB;EN-US;294807

URLScan
UrlScan version 2.5 is a security tool that restricts the types of HTTP requests that Internet Information Services will process. By blocking specific HTTP requests, the UrlScan security toolhelps prevent potentially harmful requests from reaching the server.URLSCan is an ISAPI filter that was designed to block extremely long or incorrectly formatted
web requests, which are common means of expoiting buffer overflows. It also can block avariety of verbs and commands in web requests that can exploit security holes orconfiguration errors.
URLScan 2.5 consists of URLScan.dll, the ISAPI filter, and URLScan.ini, the configuration file. The SMS 2003 toolkit has a modified version of the URLScan.ini file that allows theManagement Point ISAPI extensions to pass through. Any previous version of this ini file will cause URLScan to block client communication with the management point. Clients will be able to download packages for advertisements they already know about, but they won’t be able to get policy updates or upload inventory. An incorrect version of URLScan on an SMS MP will show up in the IIS logs as:

2005-02-04 17:03:48 10.128.22.240 GET /ccm_system/request - 80 -
10.128.22.136 ccmhttp 404 0 2
2005-02-04 17:03:48 10.128.22.240 GET /ccm_system/request - 80 -
10.128.22.174 ccmhttp 404 0 2
2005-02-04 17:03:50 10.128.22.240 GET /ccm_system/request - 80 -
10.128.22.148 ccmhttp 404 0 2

NTFS Permissions for IUSR
This section will talk about the standard default NTFS permissions in a typical SMS environment. In a typical SMS environment, you will have a Management Point, a Reporting Point; BITS enabled Distribution Point, and a Server Locator Point. Each of these SMS site components requires a virtual directory within IIS and subsequently NTFS permissions for each of those virtual directories.
Below is the default breakdown for those SMS components for reference.
Management Point (SMS_MP virtual directory)
○ Default path: c:\SMS_CCM\SMS_MP
○ Default NTFS Permissions:
■ Administrators-Full Control
■ Interactive-List Folder Contents
■ IUSR account-List Folder Contents
■ IWAM account-List Folder Contents
■ SYSTEM-Full Control
Management Point (CCM_Incoming virtual directory)
○ Default path: c:\sms\ccm\incoming
○ Default NTFS Permissions:
■ Administrators-Full Control
■ IUSR account-Special:
□ Traverse Folder/Execute File
□ List Folder/Read Data
□ Read Attributes
□ Read Extended Attributes
□ Create Files/Write Data
□ Create Folders/Append Data
□ Delete subfolders and files
□ Read Permissions
■ IWAM account Special:
□ Traverse Folder/Execute File
□ List Folder/Read Data
□ Read Attributes
□ Read Extended Attributes
□ Create Files/Write Data
□ Create Folders/Append Data
□ Delete subfolders and files
□ Read Permissions
■ SYSTEM-Full Control
Management Point (CCM_Outgoing virtual directory)
○ Default Path: c;\SMS\CCM\Outgoing
○ Default Permissions:
■ Administrators-Full Control
■ IUSR Account-Read
■ IWAM Account-Read
■ SYSTEM-Full Control
Management Point (CCM_SYSTEM virtual directory)
○ Default Path: c:\SMS\CCM\ ServiceData\System
○ Default Permissions:
■ Administrators-Full Control
■ Interactive-List folder contents
■ IUSR Account-List folder contents
■ IWAM Account-List folder contents
■ SYSTEM-Full Control
Reporting Point (SMSReporting virtual directory)
○ Default Path: C:\inetpub\wwwroot\SMSReporting_
○ Default Permissions:
■ Administrators-Full Control
■ SMS Reporting Users
□ Read & Execute
□ List Folder Contents
□ Read
■ SYSTEM-Full Control
BITS Distribution Point (SMS_DP_SMSPKGC$)
○ Default Path: C:\SMSPKGC$
○ Default Permissions:
■ Administrators-Full Control
■ Guests
□ Read & Execute
□ List Folder Contents
□ Read
■ Users
□ Read & Execute
□ List Folder Contents
□ Read
Server Locator Point (SMS_SLP virtual directory)
○ Default Path: C:\SMS\BIN\I386\SMS_SLP
○ Default Permissions:
■ Administrators-Full Control
■ Everyone
□ Read & Execute
□ List Folder Contents
□ Read
■ SYSTEM-Full Control
Resetting the Password for IUSR
This section will describe how to perform a manual IUSR reset if the issue arises where the
IUSR becomes out of sync via either a attempted manual removal of IIS or a failed attempt to
reset the password via the AD Users and Computers or local user interface if a member
server.
1. Reset the IUSR Password via the local user reset password option or use AD Users and
Computers if the machine happens to be a domain controller.
2. Reset the IUSR Password in the metabase.xml or metabase.bin file using the Metabase
Explorer tool which can be downloaded from the below URL link:
http://www.microsoft.com/downloads/details.aspx?FamilyID=56fc92ee-a71a-4c73-
b628-ade629c89499&displaylang=en
a. Open metabase explorer on the target machine where the password will be reset.

- A good plan is also to take a network trace from traffic between client – MP and MP – server

SMS Query to get Server Inventory Report

2010-01-21T15:36:00.000+08:00

For the server inventory, pls run the below query on SQL server management studio.

select distinct a.name0,a.user_name0, a.operating_system_name_and0, a.ad_site_name0,
b.manufacturer0,b.model0,c.releasedate0,c.serialnumber0,e.size0,
f.csdversion0,g.currentclockspeed0,h.totalphysicalmemory0
from v_r_system a,v_GS_COMPUTER_SYSTEM b,v_GS_PC_BIOS c,
v_GS_ADD_REMOVE_PROGRAMS d,v_GS_PARTITION e,v_GS_OPERATING_SYSTEM f,
v_GS_PROCESSOR g,v_GS_X86_PC_MEMORY h
where (a.resourceid=b.resourceid and b.resourceid=c.resourceid
and c.resourceid=d.resourceid and d.resourceid=e.resourceid
and e.resourceid=f.resourceid and f.resourceid=g.resourceid
and g.resourceid=h.resourceid)and a.operating_system_name_and0 like '%server%'

For any further help, pls leave a comment.

SMS Query to get Asset Inventory Report of all the workstations

2010-01-21T15:34:00.000+08:00

I created this sms query to get the TCO report for the management:(Which now being used as Asset Inventory Report)

select distinct a.name0,a.user_name0, a.operating_system_name_and0, a.ad_site_name0,
b.manufacturer0,b.model0,c.releasedate0,c.serialnumber0,e.size0,
f.csdversion0,g.currentclockspeed0,h.totalphysicalmemory0
from v_r_system a,v_GS_COMPUTER_SYSTEM b,v_GS_PC_BIOS c,
v_GS_ADD_REMOVE_PROGRAMS d,v_GS_PARTITION e,v_GS_OPERATING_SYSTEM f,
v_GS_PROCESSOR g,v_GS_X86_PC_MEMORY h
where (a.resourceid=b.resourceid and b.resourceid=c.resourceid
and c.resourceid=d.resourceid and d.resourceid=e.resourceid
and e.resourceid=f.resourceid and f.resourceid=g.resourceid
and g.resourceid=h.resourceid)and a.operating_system_name_and0 like '%workstation%'

After getting the data, you need to keep these data in excel sheet and apply the advanced filter as some of the time, we get duplicate data after running query.

For any further help, pls mail me or leave a comment.

TechNet Webcast: Technical Overview: System Center Configuration Manager 2007 SP2 and R3 (Level 200)

2010-01-19T18:10:00.000+08:00

Here's the link below:

http://msevents.microsoft.com/cui/WebCastEventDetails.aspx?culture=en-US&EventID=1032428201&CountryCode=US

Let's enhance our skills.

What's New in Microsoft System Center Operations Manager 2007 R2 ?

2010-01-19T18:08:00.000+08:00

Microsoft System Center Operations Manager 2007 R2 delivers end-to-end service management of applications and IT services running across your datacenter fabric, providing you greater control and insight into the health and performance of your Microsoft, UNIX, and Linux servers, and the workloads running on them. With Operations Manager 2007 R2, you can reduce the cost of managing your datacenter, and assure delivery of IT services to expected and agreed levels.

Download Operations Manager 2007 R2:
http://technet.microsoft.com/en-us/evalcenter/bb738014.aspx

Enhances application performance and availability across platforms in the datacenter through cross platform monitoring, delivering an integrated experience for discovery and management of systems and their workloads, whether Windows, UNIX or Linux.

Download the Service Level DashboardEnhances performance management of applications in the datacenter with service level monitoring, delivering the ability to granularly define service level objectives that can be targeted against the different components that comprise an IT service.

Increases the speed of access to monitoring information and functionality with UI improvements and simplified management pack authoring. Examples include an enhanced console performance and dramatically improved monitoring scalability (e.g., over 1000 URLs can be validated per agent, allowing scaling to the largest of web-based workloads)

New Features added in USMT 4.0

2010-01-19T18:05:00.001+08:00

Overall Changes from USMT 3.0

Hard-link migration store
The new hard-link migration store is for use in computer-refresh scenarios only. Hard-link migration stores are stored locally on the computer that is being refreshed and can migrate user accounts, files and settings in less time using megabytes of disk space instead of gigabytes.

Improved Space estimation
The ScanState command now more accurately estimates the size of the migration store as well as the additional temporary disk space required to create the migration store. This results in a reduction of migration failures due to low disk space. The ScanState command now also estimates the size of the compressed migration store.

Ability to gather data from an offline Windows® operating system using the ScanState command

You can gather data from an offline Windows® operating system using the ScanState command in Microsoft® Windows PE. In addition, USMT now supports migrations from previous installations of Windows® contained in Windows.old directories. The offline directory can be a Windows directory when you run the ScanState command in Windows PE or to Windows.old when you run the ScanState command in Windows.

Domain controller access is no longer required by ScanState and LoadState. It is now possible to complete an end-to-end migration of domain user accounts without having domain controller access. The destination computer must be domain-joined before any newly applied domain accounts can be used.

Integration with Microsoft System Center Configuration Manager (SCCM) and the Microsoft Deployment Toolkit (MDT)

You can reduce end-user and deployment time. You can use USMT 4.0 to retain end-users’ digital identities as well as application and operating system settings, in conjunction with SCCM and/or MDT.

Configurable file errors
You can use the new section in the Config.xml file to configure which file or registry read/write errors can be safely ignored by the /c command-line option and which might cause the migration to fail. In addition, the /genconfig command-line option now generates a sample section that is enabled by specifying error messages and desired behaviors in the Config.xml file.

New helper functions
The ScanState command has two new helper functions that enable new migration scenarios. The MigXmlHelper.FileProperties function can be used to control which files migrate, based on properties you specify; for example, date created, date modified, date accessed, and file size. The MigXmlHelper.GenerateDocPatterns function can be used to automatically find user documents on a computer without authoring extensive custom migration .xml files.

Volume shadow copy support
With the /vsc command line option, the ScanState command can now use the volume shadow copy service to capture files that are locked for editing by other applications.

Local group migration
You can use the new section in the Config.xml file to configure the local group membership of users during the migration. This enables scenarios such as changing users from being members of the local administrators group to being members of the local users group during the migration.

List files being migrated
You can use the /listfiles command-line option for the ScanState command to generate a text file list of all files included in the migration.

Usmtutils.exe
This new executable file supplements the functionality in Scanstate.exe and Loadstate.exe.

New AES encryption options
USMT 4.0 enables support for stronger encryption algorithms, called Advanced Encryption Standard (AES), in several key size options, based on support in the source computers' operating system.

Basic difference between .MSI and .MST File

2010-01-19T17:50:00.000+08:00

Packages (.MSI files)

This is the file that contains the instructions for MSIEXEC.EXE to install the application. The MSI file is a Database file format and is now the preferred application packaging format for the windows platform. Sometimes the MSI file gets too big and some or all of the files are placed in a .CAB file.

Transforms (.MST files)

In the MSI world, if you didn't create the MSI file, you want to keep the MSI file from the developer intact. To make changes beyond what the original MSI does you use a transform. The transform is applied at the time that the MSI package is installed.If you would repackage an application and it would fail, the Original Developer of the application would sometimes refuse to support it since repackaging strips out their installation logic.

If you create your own MSI packages you can also use transforms to change some parameters for each department of your company. That way you have only one package to maintain and nobody can accuse you of doing a better package for one department vs. another.

Note: Transform files are in fact MSI files with a different file extension. The contents of both files are merged together at install time. They are not supposed to add files to the package but there are way. Wise Package Studio does allow adding files using Transforms but they create a CAB file to bring files in without breaking the MSI rules.

MSI Authoring Tools

2010-01-19T17:45:00.003+08:00

MSI Authoring Tools: The below are tools which can be used to edit MSI packages-

•InstallShield Developer
•Wise for Windows Installer
•InstallAware
•AdvancedInstaller
•InstallShield Express
•InstallShield DevStudio
•InstallConstruct
•Instyler EX-it!
•MaSaI Editor
•Setup2Go
•Wise for Visual Studio.NET

InstallShield Command Line Parameters

2010-01-19T17:43:00.003+08:00

The following are the InstallShield Command Line Parameters:

/v Passes parameters to MSI package.
/s Causes setup.exe to be silent.
/l Specifies the setup language.
/a Performs administrative installation.
/j Installs in advertise mode.
/x Performs setup uninstall.
/f Launches setup in repair mode.
/w Setup.exe waits for the installation to finish before exiting.
/qn A Windows Installer MSI parameter that causes everything but setup.exe to be silent. This sets the user interface level to zero.

MSI Repackaging Tools

2010-01-19T17:43:00.000+08:00

1. AdminStudio
2. Package Studio
3. WiX
4. InstallAware
5. MSI Studio
6. MAKEMSI
7. Prism Pack
8. WinInstall
9. RapidInstall (Deployment Solution)
10. SMS Installer
11. NetInstall
12. MSI Packager
13. InstallSpy
14. Wise Packaging Studio

Script to ping a list of machines and export result in Excel File

2010-01-19T13:18:00.000+08:00

Please create a file "MachineList.txt" and include machine name in this file.

copy the below script in notepad and save as "ping_result.vbs" file.
run the script in command prompt by specifying the same path.

run method: cscript ping_result.vbs

Script:

Set objExcel = CreateObject("Excel.Application")
objExcel.Visible = True
objExcel.Workbooks.Add
intRow = 2

objExcel.Cells(1, 1).Value = "Machine Name"
objExcel.Cells(1, 2).Value = "Results"

Set Fso = CreateObject("Scripting.FileSystemObject")
Set InputFile = fso.OpenTextFile("MachineList.Txt")

Do While Not (InputFile.atEndOfStream)
HostName = InputFile.ReadLine

Set WshShell = WScript.CreateObject("WScript.Shell")
Ping = WshShell.Run("ping -n 1 " & HostName, 0, True)

objExcel.Cells(intRow, 1).Value = HostName

Select Case Ping
Case 0 objExcel.Cells(intRow, 2).Value = "On Line"
Case 1 objExcel.Cells(intRow, 2).Value = "Off Line"
End Select

intRow = intRow + 1
Loop

objExcel.Range("A1:B1").Select
objExcel.Selection.Interior.ColorIndex = 19
objExcel.Selection.Font.ColorIndex = 11
objExcel.Selection.Font.Bold = True
objExcel.Cells.EntireColumn.AutoFit

Script to connect to an SMS Provider

2010-01-19T13:00:00.002+08:00

' Connect to an SMS Provider

Dim objSwbemLocator
Dim objSWbemServices
Dim ProviderLoc
Dim Location

set objSWbemLocator = CreateObject("WbemScripting.SWbemLocator")

set objSWbemServices= objSWbemLocator.ConnectServer _
(".", "root\sms")

Set ProviderLoc = objSWbemServices.InstancesOf("SMS_ProviderLocation")

For Each Location In ProviderLoc
If Location.ProviderForLocalSite = True Then
Set objSWbemServices = objSWbemLocator.ConnectServer _
(Location.Machine, "root\sms\site_" + Location.SiteCode)
End If
Next

Script to update SMS Package

2010-01-19T12:54:00.002+08:00

On Error Resume Next
Dim objSWbemLocator
Dim objSWbemServices
Dim ProviderLoc
Dim Location
Dim PackageID
Dim colPackages
Dim Package

'Enter the package ID of the package to be updated
PackageID = "PACKAGEID"

'To connect to the local SMS site's Provider by using SWbemLocator
Set objSWbemLocator = CreateObject("WbemScripting.SWbemLocator")

Set objSWbemServices= objSWbemLocator.ConnectServer(".", "root\sms")
Set ProviderLoc = objSWbemServices.InstancesOf("SMS_ProviderLocation")

For Each Location In ProviderLoc
If Location.ProviderForLocalSite = True Then
Set objSWbemServices = objSWbemLocator.ConnectServer _
(Location.Machine, "root\sms\site_" + Location.SiteCode)
End If
Next

'To find the package ID in the SMS_Packages class and use the RefreshPkgSource Method to initiate update.
Set colPackages = objSWbemServices.ExecQuery _
("Select * from SMS_Package where PackageID = '" & PackageID & "'")

If colPackages.count <;>; 0 Then
For Each Package In colPackages
Package.RefreshPkgSource( )
WScript.Echo "Package '" & PackageID & "' Updated!"
Next
Else
WScript.Echo "Package '" & PackageID & "' Not Found!"
End If

The Configuration Manager 2007 Toolkit

2010-01-18T19:41:00.002+08:00

The Configuration Manager 2007 Toolkit - Microsoft’s System Center Configuration Manager 2007 Toolkit contains a number of tools to help you manage and troubleshoot ConfigMgr 2007.
You can download the Toolkit from http://www.microsoft.com/downloads/details.aspx?familyid=948e477e-fd3b-4a09-9015-141683c7ad5f&displaylang=en (or go to http://www.microsoft.com/downloads and search for System Center Configuration Manager 2007 Toolkit).

Hardware Inventory Through WMI

2010-01-18T19:38:00.002+08:00

ConfigMgr uses two MOF files to control hardware inventory:

SMS_Def.mof—Specifies the information reported to the management point during the client inventory retrieval cycle. The actual SMS_Def.mof file is not downloaded to the ConfigMgr client. Instead, the client receives changes to reporting class configuration as part of its machine policy.

Configuration.mof—Defines custom data classes the hardware inventory client agent will inventory. In addition to standard WMI classes, such as the Win32 classes, you can create data classes to provide inventory data that is accessible through WMI, such as data from the client’s system Registry. ConfigMgr clients download the Configuration.mof file as part of their machine policy retrieval cycle. Any changes are compiled and loaded into the WMI repository.

The ConfigMgr client stores its machine policy in the Root\CCM\Policy\Machine WMI namespace. You can use the WMI Object Browser from the WMI Administrative Tools to examine some to the inventory-related objects in this namespace. To launch the WMI Object Browser and connect to the ConfigMgr machine policy namespace, perform the following steps:

1.Select Start -> All Programs -> WMI Tools -> WMI Object Browser.
2.The WMI Object Browser opens a web browser and attempts to run an ActiveX control.
3.If your browser blocks the control, select the option Allow Blocked Content.
4.Change the entry in the Connect to namespace dialog box to Root\CCM\Policy\Machine and then click OK.
5.Click OK to accept the default logon settings.

Using the WMIDiag Utility

2010-01-18T19:35:00.002+08:00

Using the WMIDiag Utility - SMS was one of the first applications to take advantage of WMI. At one time, SMS was often the only WMI management application running on many Windows machines. In those days, it was a common practice among SMS administrators to simply delete the repository when WMI errors were detected, and then restart WMI to re-create the repository. This is no longer a safe practice, because many applications depend on data stored in the repository. Moreover, WMI errors can result from many other problems in your environment and may have nothing to do with WMI itself.

Rather than deleting the repository, you should obtain the WMI Diagnosis Utility (WMIDiag) from the Microsoft download site (http://www.microsoft.com/downloads/details.aspx?familyid=d7ba3cd6-18d1-4d05-b11e-4c64192ae97d&displaylang=en, or go to http://www.microsoft.com/downloads and search for WMIDiag). WMIDiag can help you diagnose most WMI problems, and in many cases it provides detailed instructions on how to correct those problems.

How can I manage WMI?

2010-01-18T19:34:00.001+08:00

The Windows WMI Control is a graphical tool for managing the most important properties of the WMI infrastructure. Only members of the local Administrators group can use the WMI Control. To run this tool, perform the following steps:

1.Launch the Computer Management MMC snap-in. The exact procedure will vary depending on the version of Windows you are running. Generally you can right-click Computer or My Computer, and choose Manage.

2.Expand the Services and Applications node in the tree pane.

3.Right-click WMI Control and choose Properties.

Managing WMI on a Remote Machine - You can use the WMI Control tool to manage WMI on the local machine or on a remote machine. To connect to WMI on a remote machine, you follow the same procedure previously described in this section, with one additional step. Immediately after step 1, right-click the Computer Management node at the top of the tree and choose Connect to another computer. Then enter the name or IP address of the computer you want to manage and click OK. After connecting to the remote machine, complete steps 2 and 3 in the procedure.

Note that in addition to administrative privilege on the remote machine, you will need appropriate DCOM permissions (described later in this section). Also, DCOM network protocols must not be blocked on the remote machine or on any intermediary devices.

How WMI fetch data?

2010-01-18T19:32:00.001+08:00

1.Management applications submit a request to the WMI infrastructure, which passes the request to the appropriate provider.

2.The provider then handles the interaction with the actual system resources and returns the resulting response to WMI.

3.WMI passes the response back to the calling application. The response may be actual data about the resource or the result of a requested operation.

Understanding difference between WQL and SQL

2010-01-18T19:30:00.003+08:00

Below are few points which make difference between WQL and SQL-

WMI provides its own query language that allows you to query managed objects as data providers
WMI Query Language (WQL) is essentially a subset of SQL (Structured Query Language) with minor semantic changes.
Unlike SQL, WQL does not provide statements for inserting, deleting, or updating data and does not support stored procedures.
WQL does have extensions that support WMI events and other features specific to WMI. WQL is the basis for Configuration Manager queries, whereas SQL is used for ConfigMgr reports.
One important advantage of WQL is that a WQL query can return WMI objects as well as specific properties.
Because management applications such as the Configuration Manager console interact with WMI objects, WQL queries can return result sets that you can use within the ConfigMgr infrastructure.

For example, Configuration Manager collections are based on WQL queries.

Hope it helps!

Benefits of Extending Active Directory

2010-01-18T19:28:00.001+08:00

Once you extend the Active Directory schema and perform the other steps necessary to publish site information to AD, clients in the same AD forest as your ConfigMgr sites can query AD to locate Configuration Manager services and retrieve important information about your ConfigMgr sites. Those clients in workgroups and domains without trust relationships are not able to take advantage of the schema extensions.

The following ConfigMgr features require extending the AD schema and publishing site information to AD:

Global roaming—Roaming in ConfigMgr allows clients such as laptop computers to connect to the network at various locations and receive certain services from the local site. The schema extensions allow a client to query AD for the mSSMSRoamingBoundaryRange objects and determine whether a site exists on the IP subnet of their current network location. This is known as global roaming. Without the schema extensions, clients can only receive services when at their assigned site or roaming to the sites below their assigned site in the ConfigMgr hierarchy.

Global roaming can make content available to clients at network locations where it would otherwise not be available. Global roaming can also prevent unnecessary network traffic otherwise caused by those clients at remote locations requiring services from their assigned site.

Network Access Protection—You can use ConfigMgr’s NAP capabilities to prevent clients that do not comply with specified security patch requirements from connecting to the network. NAP requires the client to retrieve health state reference information stored in the attributes of the mSSMSSite AD object.

Client site assignment—To receive ConfigMgr services, you must first assign a client system to a site. The schema extensions provide an option for the client to retrieve the information from AD that it needs to identify and contact its assigned site.

Client installation properties—A number of configurable options, such as the size of the download cache, are available through the extended schema.

Site mode settings—The extended schema can supply information to the client about the site’s security mode and certificate information required for native sites.

Server locator point and management points—Clients can use Active Directory to identify the server locator point and management points. Without the schema extensions you must provide this information in other ways, such as manually creating special Windows Internet Naming Service (WINS) entries.

Custom Transmission Control Protocol (TCP)/Internet Protocol (IP) Port information—If a site has been configured to use nonstandard ports for client communications, this information can be provided through the schema extensions.

In addition, the schema extensions allow for automated public key exchange, thus facilitating site-to-site communication. If you have clients assigned to your central site and do not have the schema extended, recovery from a site failure can require reprovisioning all clients manually using the trusted root key.

ConfigMgr 2007 schema modifications

2010-01-18T19:24:00.000+08:00

ConfigMgr 2007 schema modifications create four new classes and 14 new attributes used with these classes. The classes created represent the following:

Management points—Clients can use this information to find a management point.

Roaming boundary ranges—Clients can use this information to locate ConfigMgr services when they connect to the network at a location not within the boundaries of their assigned site.

Server locator points (SLPs)—Clients can use this information to find an SLP.

ConfigMgr sites—Clients can retrieve important information about the site from this AD object.

Introduction to COM - What It Is and How to Use It?

2010-01-18T19:05:00.000+08:00

Very useful information. Pls refer to below link-

http://www.codeproject.com/KB/COM/comintro.aspx

ID Mifs Vs No ID Mifs

2010-01-18T18:44:00.002+08:00

For SMS, standard MIF files are called NOIDMIF files. These files do not contain a unique identifier for the data. They have no ID. SMS automatically associates NOIDMIF file data with the computer that the NOIDMIF files are collected from.

SMS also supports IDMIF MIF files. These files do contain a unique ID, and are not associated with the computer they are collected from. IDMIF files can be used to collect inventory data about devices that are in the vicinity of a computer, but not actually associated with it. For example, a shared network printer, video cassette recorder, photocopier, or similar equipment is not associated with any specific computer, but you might want to record data about it for asset management purposes. This data is stored in separate tables in the SMS site database.

IDMIF extensions (or custom DDRs) can also be used to create new tables in the SMS site database that you might need for reporting purposes. For example, you might have asset management data that is not strongly tied to individual computers. This data is not appropriate for NOIDMIF files or MOF extensions, but you want to join it with SMS data for reporting purposes.

What is MIF: Management Information Format? Why SCCM use it?

2010-01-18T18:41:00.000+08:00

Management Information Format (MIF file) is a format used to describe a hardware or software component. MIF files are used by Desktop Management Interface (DMI) to report system configuration information. Although MIF is a system-independent format, it is used primarily by Windows systems. To install a new device in a Windows 95 system, the corresponding MIF file is needed.

SCCM can use MIF files to determine the success or failure of an installation. After a program has finished executing, SCCM will look in the %windir% and %temp% directories for new MIF files (created after the time of the program execution start) and then match them on any or all of the following criteria:

•Name of the MIF file (only need to specify the name portion, leaving off the “.MIF”, in package properties)
•Publisher
•Name
•Version

WMI Tools

2010-01-17T23:12:00.000+08:00

Some WMI tools can also be useful during the design and development phases. These tools are:

The MOF compiler (MOFComp.exe):
The Managed Object Format (MOF) compiler parses a file containing Managed Object Format statements and adds the classes and class instances defined in the file to the CIM repository. The MOF format is a specific syntax to define CIM class representation in an ASCII file (e.g. MIB are to SNMP what MOF files are to CIM). MOFComp.exe is included in every WMI installation. Every definition existing in the CIM repository is initially defined in an MOF file. MOF files are located in %SystemRoot%\System32\WBEM. During the WMI setup, they are loaded in the CIM repository.
The WMI Administrative Tools: The WMI Administrative Tools are made of four tools: WMI CIM Studio, WMI Object Browser, WMI Event Registration and WMI Event Viewer.

WMI Administrative Tools can be downloaded here.

http://www.microsoft.com/downloads/details.aspx?FamilyID=6430f853-1120-48db-8cc5-f2abdc3ed314&DisplayLang=en

The most important tool for a WMI provider developer is WMI CIM Studio as it helps in the initial WMI class creation in the CIM repository. It uses a web interface to display information and relies on a collection of ActiveX components installed on the system when it runs for the first time.
WMI CIM Studio provides the ability to:
1.Connect to a chosen system and browse the CIM repository in any namespace available.
2.Search for classes by their name, by their descriptions or by property names.
3.Review the properties, methods and associations related to a given class.
See the instances available for a given class of the examined system.
4.Perform Queries in the WQL language.
5.Generate an MOF file based on selected classes.
6.Compile an MOF file to load it in the CIM repository.

WinMgmt.exe:
WinMgmt.exe is not a tool; it is the executable that implements the WMI Core service. Under the Windows NT family of operating systems, WMI runs as a service. On computers running Windows 98, Windows 95 or Windows Me, WMI runs as an application. Under the Windows NT family of operating systems, it is also possible to run this executable as an application, in which case, the executable runs in the current user context. For this, the WMI service must be stopped first. The executable supports some switches that can be useful when starting WMI as a service or as an application. WMI provider developers who may want to debug their providers essentially need to run the WMI service as an application.

WBEMTest.exe:
WBEMTest.exe is a WMI tester tool, which is delivered with WMI. This tool allows an administrator or a developer to perform most of the tasks from a graphical interface that WMI provides at the API level. Although available under all Windows NT-based operating systems, this tool is not officially supported by Microsoft. WBEMTest provides the ability to:
1.Enumerate, open, create and delete classes.
2.Enumerate, open, create and delete instances of classes.
3.Select a namespace.
4.Perform data and event queries.
5.Execute methods associated to classes or instances.
6.Execute every WMI operation asynchronously, synchronously or semi-asynchronously.

The WMI command line tool (WMIC):
WMIC is a command-line tool designed to ease WMI information retrieval about a system by using some simple keywords (aliases). WMIC.exe is only available under Windows XP Professional, Windows Server 2003, Windows Vista and Windows Server 2008. By typing “WMIC /?” from the command-line, a complete list of the switches and reserved keywords is available. ( windows vista users, "WMIC /?" won't work, instead type only "/?" )
There is a Linux port of WMI command line tool, written in Python, based on Samba called 'wmi-client'

WBEMDump.exe:
WBEMDump is a tool delivered with the Platform SDK. This command line tool comes with its own Visual C++ project. The tool can show the CIM repository classes, instances, or both. It is possible to retrieve the same information as that retrieved with WMIC. WBEMDump.exe requires more specific knowledge about WMI, as it doesn’t abstract WMI as WMIC. However, it runs under Windows NT 4.0 and Windows 2000. It is also possible to execute methods exposed by classes or instances. Even if it is not a standard WMI tool delivered with the system installation, this tool can be quite useful for exploring the CIM repository and WMI features.

SMS: WMI terms and concepts

2010-01-17T23:06:00.000+08:00

WBEM is a unifying architecture that allows access to data from a variety of underlying technologies - including Win32, WMI, the Desktop Management Interface (DMI), and the Simple Network Management Protocol (SNMP). WBEM is based upon the Common Information Model (CIM) schema, which is an industry standard driven by the Desktop Management Task Force (DMTF).

The Systems Management Server Site Database, Administrator Console and the Client Hardware Inventory component all depend on WMI.

WBEM provides a three-tiered approach for collecting and providing management data. This approach consists of a standard mechanism for storing data (a CIM-compliant database), a standard protocol for obtaining and disseminating management data (COM/DCOM; other protocols are also possible and under investigation), and a Win32 DLL known as a WBEM provider.

CIM and CIMOM
A component of the CIM (Common Information Model) is the CIMOM (Common Information Model Object Manager) repository. This datastore is where providers determine how to retrieve their information.

Although not technically accurate, it helps to think of the CIMOM in terms of a database. Definitions of WMI terms, and the corresponding concept in database terminology are in the following list.

WBEM term WBEM definition Database term
-------------------------------------------------------------
Namespace A collection of all classes. Database

Class Describes datatypes in a
schema. Object class definition. Table
Properties A single attribute of a class. Column
Instance One object of this class type. Row
Value The data for a property of a Field
specific instance.

Providers and WBEM
A WBEM provider supplies instrumentation data for parts of the CIM schema. Microsoft has written the WMI provider (a WBEM provider) that interfaces with the kernel mode WMI component. The kernel mode WMI component provides services that allow WMI-enabled drivers to implement WMI, and also acts as an interface to the WMI provider.

Systems Management Server uses the SMS Site Provider as the mechanism between the SMS Administrator's Console and the site server's SQL database. The Systems Management Server Hardware Inventory Client component uses the WMI Win32 provider.

How SMS Uses WMI

2010-01-17T15:29:00.002+08:00

SMS uses WMI to collect information about SMS clients and for the management and operation of SMS itself. Specifically, SMS uses WMI for:

The SMS Administrator console, which gathers and sets all SMS configuration and inventory details (using the root\SMS\site_ namespace).

Resource Explorer, which gathers inventory data from the same namespace as the SMS Administrator console, but uses the group classes for a specific computer. Resource Explorer also uses the SMS_PropertyDisplayNode class in the root\SMS\inv_schema namespace for window formatting details.

All other SMS administration tools, including support tools, resource kit tools, recovery tools, scripts, and any tools you have written with the SMS software development kit (SDK).

The Legacy Client Hardware Inventory Agent, which gathers hardware inventory data from WMI (by default from the root\CIMv2 namespace), and records which WMI classes should be reported by the Legacy Client Hardware Inventory Agent. The classes that the agent should report are recorded in the root\CIMv2\SMS namespace. The settings in that namespace are usually transferred to clients by using the SMS_def.mof file. The \root\CIMv2\SMS\Delta namespace records the values of the classes when they were last reported, so that hardware inventory deltas can be calculated.

The Advanced Client. Configuration policies and most client data are stored in WMI in the root\CCM namespace and its namespaces.

The Advanced Client Inventory Agent, which gathers hardware inventory data from WMI (by default from the root\CIMv2 namespace) and records the values of the classes when they were last reported, so that hardware inventory deltas can be calculated.

The SMS Provider and SMS Component Management Provider, which use WMI as the interface model and store some details in the WMI repository. The SMS Provider also uses the root\SMS\inv_schema namespace for localization details.

Queries and collections, which use the WBEM Query Language (WQL) and the SMS Provider.

Network Discovery. Configuration options are stored in the root\NetworkModel namespace.

Network Trace, which uses the SMS Component Management Provider and SMS Component Polling Provider.

Reporting (using tools other than the reporting tool included in SMS 2003 or that use the SMS SQL Server views), which uses the WBEM Open Database Connectivity (ODBC) driver. ODBC is a commonly used database interface.

A pointer to the SMS Provider server, which uses the root\SMS\SMS_ProviderLocation class.

Because SMS uses WMI, you can:

Script SMS operations to ease your SMS administration tasks. For more information, see Appendix C, "Scripting SMS Operations."

Increase or decrease the details that SMS collects as part of the hardware inventory. For more information, see Chapter 2, "Collecting Hardware and Software Inventory."

Build tools to manage SMS. For more information, see the SMS SDK.

Directly connect to client computers, if they are accessible on your network, to verify in real-time any details that you see in Resource Explorer.

Links to download Windows Server 2003 Tools

2010-01-16T22:14:00.002+08:00

http://technet.microsoft.com/en-us/windowsserver/bb405955.aspx

Windows Server 2003 Tools

2010-01-16T22:11:00.000+08:00

Active Directory Migration Tool v.3.0
The Active Directory Migration Tool version 3 (ADMT v3) provides an integrated toolset to facilitate migration and restructuring tasks in an Active Directory infrastructure.

Domain Rename Tools
The Windows Server 2003 Active Directory Domain Rename Tools provide a security-enhanced and supported methodology to rename one or more domains (as well as application directory partitions) in a deployed Active Directory forest. The DNS name and the NetBIOS name of a domain can be changed using the domain rename procedure.

File Replication Services (FRS) Monitoring and Troubleshooting Tools
File Replication Service (FRS) is the replication engine used by Windows Server 2003 to keep Distributed File System (DFS) shares synchronized. FRS is also used by the operating system to replicate the contents of the SYSVOL folder in domain controllers and is integral to the domain controller advertising itself. In either scenario, it is important to ensure that the service is functioning properly and that replicated content is in a consistent state.
Internet Information Services Downloads
This page links to a variety of tools and other resources for migrating and enhancing Internet Information Services (IIS) 6.0.
Log Parser 2.2 Tool
Log parser is a powerful, versatile tool that provides universal query access to text-based data such as log files, XML files and CSV files, as well as key data sources on the Windows operating system such as the Event Log, the Registry, the file system, and Active Directory.

Microsoft File Server Migration Toolkit
With Microsoft File Server Migration Toolkit system administrators can easily migrate shared folders from servers running Windows NT Server 4.0 or the Windows 2000 family of servers, to a server running Windows Server 2003 or Windows Storage Server 2003.

Microsoft Operations Manager Base Management Pack
The Microsoft Operations Manager Base Management Pack modules provide preconfigured rules, responses, and prescriptive advice for managing Microsoft Windows Server 2003 and Windows 2000 services, including the Active Directory directory service, IIS, and networking and file replication services.

Microsoft Operations Manager Resource Kit Tools
These resource kit tools help you simplify and enhance the management of your Windows–based platform. Tools include the Server Status Monitor (SSM), which enables you to monitor the simple up or down status of a small group of servers.

MIIS 2003 Management Pack for Microsoft Operations Manager
The Microsoft Identity Integration Server (MIIS) 2003 Management Pack for Microsoft Operations Manager (MOM) monitors MIIS 2003 components and helps ensure that all necessary services that support MIIS 2003 are running, identity integration is performing normally and predictably, automation of identity integration does not result in data corruption or loss, and any events that could adversely affect MIIS 2003 or MIIS 2003-managed systems are visible.

MIIS 2003 Management Pack Guide for Microsoft Operations Manager
This is the guide to the MIIS 2003 Management Pack for MOM, which provides monitoring data for each of the MIIS 2003 solution scenarios. This document provides guidance on how MIIS 2003 enables the integration and management of identity information across multiple repositories, systems, and platforms.

MIIS 2003 Resource Tool Kit
The Microsoft Identity Integration Server 2003 Resource Tool Kit adds functionality and flexibility for remote administration and configuration of an MIIS 2003 server. Use these tools to parse input files, view management agent configurations, run management agents in batch mode, search for domain and directory information, archive files, and monitor Windows Management Interface (WMI) statistics on the Windows Server 2003, Enterprise Edition, hosting MIIS 2003 and SQL Server.

Remote Desktop Connection
Remote Desktop Connection makes it possible for a user to connect remotely to a machine that has Remote Desktop or Terminal Server enabled.
Remote Desktop Web Connection
The Remote Desktop Web Connection ActiveX control allows you to access your computer through Remote Desktop, via the Internet, from another computer using Internet Explorer.

Sonar.exe: File Replication Service (FRS) Status Viewer
Sonar.exe is a command-line tool that allows administrators to monitor key statistics and status about members of a file replication service (FRS) replica set. Administrators can use Sonar to watch key statistics on a replica set in order to monitor traffic levels, backlogs, and free space.

Server Performance Advisor
This tool was developed to diagnose root causes of performance problems in Windows Server 2003, particularly for IIS 6.0 and Active Directory.

Windows Application Compatibility Toolkit 3.0
The Windows Application Compatibility Toolkit 3.0 for Windows XP and Windows Server 2003 contains the tools and documentation you need to design, deploy, and support applications on these platforms.

Windows Server 2003 Administration Tools Pack
The Windows Server 2003 Administration Tools Pack (Adminpak.msi) provides server management tools that allow administrators to remotely manage Windows 2000 Servers and Windows Server 2003 family servers. This is the final version (build 3790) of the Adminpak.msi file.
Windows Server 2003 Resource Kit Tools
The Windows Server 2003 Resource Kit Tools are a set of software tools for administrators, developers, and power users to manage Active Directory, Group Policy, TCP/IP Networks, Registry, Security, Scalability and many other areas of the Windows Server 2003 operating system.

Windows Rights Management Services Client and Server SDKs
Get the tools, documentation, and sample code you need to get started building end-to-end solutions to fit your organization's or customer's information protection needs.

Comparison of the SMS 2003 Client Health Monitoring Tool and Configuration Manager 2007 Client Status Reporting

2010-01-16T21:54:00.000+08:00

SMS 2003 Client Health Monitoring Tool
1.Uses a separate SQL database to store client health data.
2.Uses Microsoft Excel to display client health reports.
3.Contains checks for heartbeat discovery and software and hardware inventory.

Configuration Manager 2007 R2 Client Status Reporting
1.Stores client status data in the Configuration Manager 2007 site database.
2.Uses standard Configuration Manager 2007 reports which can also display trending data collected by the feature.
3.Contains additional checks for status messages.

Software Distribution Security Best Practices and Privacy Information

2010-01-16T21:35:00.000+08:00

Best Practices
Always configure advertisements to download content
Configuring to Download content from distribution point and run locally is more secure because Configuration Manager 2007 verifies the package hash after the content is downloaded and discards the package if the hash does not match the hash in the policy. If you configure the advertisement to Run program from distribution point, no verification takes place and attackers can tamper with the content. If you must run the program from the distribution point, use NTFS least permissions on the packages on the distribution points and use Internet Protocol security (IPsec) to secure the channel between the client and the distribution point and between the distribution point and the site server.

Do not allow users to interact with programs if run with administrative rights is required
When you configure a program, you can set the option Allow users to interact with this program so that users can respond to any required prompts in the user interface. If the program is also configured to Run with administrative rights, an attacker at the computer running the program could use the user interface to escalate privileges on the client computer. You should use Windows Installer-based setup programs with per-user elevated privileges for installations that require administrative credentials but that must be run in the context of a user who does not have administrative credentials. Using Windows Installer per-user elevated privileges provides the most secure way of deploying applications with this requirement.

Do not create subcollections if you need to restrict software distribution on them
An advertisement to a collection with subcollections is sent to all members of the collection and subcollections, even if the administrator has only the Advertise right to the collection (not the subcollections). Any administrator who can link a collection to another collection can cause that collection to receive the advertisements targeted to the other collection, even if they do not have Advertise permissions on any collection. For this reason, you should watch for the addition of subcollections to collections with advertisements, and be cautious of whom you give permission to for reading collections that receive advertisements.

Set package access permissions at package creation
Changes to the access accounts on the package files (as opposed to the distribution point shared folders) become effective only when you refresh the package. Therefore, you should set the package access permissions carefully when you first create the package, especially if the package is large, if you are distributing the package to many distribution points, or if your network capacity for package distributions is limited. To quickly initiate the refresh of all distribution points, you can use the Update Distribution Points task for the package.

Secure software at the package access level
By default, the package files on distribution points are fully accessible by administrators and readable by users. Users with administrative rights on client computers can set the client to join any site, even if the computer is not within the boundaries of the site. When the clients have joined the site, they can receive any software distributions that are available at that site and for which the computer or user meets the qualifications of the relevant collections. For this reason, software that should be limited to specific users should be secured at the package access level to those users, rather than being limited by site availability or collection criteria. However, restricting the access of the Internet Guest account to packages will cause package access to fail for Internet-based clients. For more information, see Example Package Access Scenarios.

After upgrading, if you had packages in SMS 2003, update all packages
SMS 2003 (released version) used MD5 to hash packages;Configuration Manager 2007 and SMS 2003 service packs later than SP1 use SHA-1. To rehash all of the packages with SHA-1, you should update all packages created in SMS 2003 (released version) that have not already been updated with an SMS service pack. Failing to do so might cause clients to discard valid packages if the advertisement is configured to download the package and run it locally.

Best Practices for Distribution Points
Remove the distribution point role from the site server By default, the site server is set up as a standard distribution point. However, you should assign this role to other site systems and remove it from the site server to reduce the attack surface. Clients have no valid reason to talk directly to the site server or any role configured on the site server. This is especially important if you chose to enable Background Intelligent Transfer Service (BITS) on the distribution point, because installing Internet Information Services (IIS) to create a BITS-enabled distribution point greatly increases the attack surface of the site system.

Do not create distribution point shares or branch distribution points on Internet-based clients
Although Configuration Manager 2007 might not block you from doing so, creating any type of distribution point on an Internet-based client greatly increases your attack surface and should be avoided. Create distribution points only on site systems that can be managed within the intranet or the perimeter network.

After switching to a custom Web site, remove the default virtual directories
When you change from using the default Web site to using a custom Web site, Configuration Manager 2007 does not automatically remove the old virtual directories. You should manually remove the virtual directories created under the default Web site. This is especially important if you configured the distribution point to Allow clients to connect anonymously (Required for mobile device clients) while using the default Web site and then you disable anonymous connections after switching to the custom Web site. In this case, the old virtual directories will still be configured for anonymous access. For the list of virtual directories created on BITS-enabled distribution points, see About BITS-Enabled Distribution Points.

Implement access controls to protect branch distribution points Branch distribution points can be installed on any Configuration Manager 2007 client, including Microsoft Windows XP Professional workstation computers. Workstation computers are generally not subject to the same physical access controls as server computers, so you must monitor your usage of branch distribution points. Do not distribute sensitive source files to branch distribution points if there is a risk of an attacker stealing the hard drive or the entire branch distribution point. You should configure all advertisements so that clients download packages from a branch distribution point and run them locally rather than running them across the network. Configuration Manager 2007 verifies the hash on downloaded packages and discards any packages it cannot verify, but there is no package verification on packages run from the distribution point.

Enable the encrypted mode for Application Virtualization Streaming–enabled distribution points
In Configuration Manager 2007 R2, when you configure an Application Virtualization Streaming–enabled distribution point, you have the option of choosing Real Time Streaming Protocol (RTSP) or RTSP over TLS (RTSPS). Enabling encryption helps protect against attackers tampering with the data stream.

Security Issue

The following issue has no mitigation.

Packages are not validated until after they are downloaded Configuration Manager 2007 validates the signatures on packages only after they have been downloaded to the client cache. If an attacker has tampered with a package, the client could waste considerable bandwidth in downloading the package only to have it discarded due to an invalid signature.

Privacy Information
Software distribution allows you to run any program or script on any client in the site. Configuration Manager 2007 has no control over what types of programs or scripts you run or what type of information they transmit. During the software distribution process, Configuration Manager 2007 might transmit information between clients and servers that identify the computer and logon accounts.

Configuration Manager 2007 maintains status information about the software distribution process. Software distribution status information is not encrypted during transmission unless you enable native mode. Status information is not stored in encrypted form in the database.

Status information is stored in the site database and deleted by default every 30 days. The deletion behavior is configurable by setting both the Status Filter Rule properties and the site maintenance task. No status information is sent back to Microsoft.

The use of Configuration Manager 2007 software installation to remotely, interactively, or silently install software on clients might be subject to software license terms for that software and is separate from the Software License Terms for Configuration Manager 2007. You should always review and agree to the Software Licensing Terms prior to installing the software using Configuration Manager 2007.

Software distribution does not happen by default and requires several configuration steps. Before configuring software distribution, consider your privacy requirements.

Choose Between a Standard and Branch Distribution Point

2010-01-16T21:28:00.000+08:00

Before deciding to protect any distribution points, you need to know the following information:

The location of all distribution points in the site

The location of all distribution points in the hierarchy if you support roaming

The location and available bandwidth of any slow network links

The largest package sizes you tend to distribute

You should consider protecting a distribution point if any of the following are true:

The distribution point is across a slow network link from other clients in the site

The distribution point is a branch distribution point

You frequently distribute large packages and want only clients closest to the distribution point to download content from it

You should be careful about protecting all distribution points in the site for the following reasons:

If all distribution points in the site are protected but not all boundaries are assigned to protected distribution points, a client belonging to an unassigned boundary will be unable to access any distribution points and the package will fail.

If a client roams to a new site and the package is not available in the resident site, the client will attempt to fall back to the assigned site but will fail if all of the distribution points in the assigned site are protected. For more information about roaming scenarios involving protected distribution points.

If you protect your distribution points, for each advertisement or software update deployment that you create, you must consider whether to allow clients to fall back to unprotected distribution points when the content is not available on the protected distribution point. Before making the decision, consider the following factors:

If the package is very large and would consume too much bandwidth, you can prevent fallback to unprotected distribution points, understanding that the clients might not receive the content at all.

If the package is small or if the content is critical, you can allow fallback to unprotected distribution points.

Choose between Server and Server Share Distribution Point

2010-01-16T21:19:00.001+08:00

Server

Advantages:
1. Configuration Manager 2007 automatically creates a common package share when the first package is copied to the distribution point.

2. There is less chance of failing to copy a package because Configuration Manager 2007 creates a new SMSPKGx$ share when more space is needed.

3. The server can be configured as a branch distribution point.

4. The server can be configured to support Internet-based clients.

Disadvantages
1. Every time Configuration Manager 2007 copies a package to the distribution point, it chooses the NTFS drive with the most free space, making it difficult to determine which drive letter will hold the new package.

2. Configuration Manager 2007 can take over all available NTFS disk space on the server.

Server Share

Advantages
Configuration Manager 2007 will not use space reserved for other functions on other partitions.

Disadvantages
1. Administrator must manually create a shared folder before creating the new site system server share.

2. Configuration Manager 2007 might fail to create a package if there is no free space on the partition where the shared folder was created.

3. Configuration Manager 2007 does not create a data discovery record (DDR) to monitor the health of the site system.

4. The server share cannot be configured as a branch distribution point.

5. The server share cannot be configured to support Internet-based clients.

Difference between Refresh DP and Update DP: SMS/SCCM

2010-01-16T20:57:00.000+08:00

Updating distribution points includes these steps:
Recopy the source files for a package to the compressed version located at the site where the package originated.
Copy the source files to the local distribution points.
Replicate the new compressed version to all child sites that are selected as distribution points for this package.

Refresh the package includes this step:
Replicate the existing compressed version of the source files to selected distribution points.