All about SCCM Learning

Sunday, October 30, 2011

SCCM 2012 now available as RC download

System Center 2012 Configuration Manager and System Center 2012 Endpoint Protection Release Candidates

download link http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=27841

Please note: System Center 2012 Configuration Manager and System Center 2012 Endpoint Protection are now provided as a single installation package.
System Center 2012 Configuration Manager helps you to empower people to use the devices and applications they need to be productive, while maintaining corporate compliance and control. As more and more consumer devices enter the workplace, IT faces the challenge of delivering a rich experience to users across multiple devices – both personal and corporate-owned – without giving up the control needed to protect company assets. Configuration Manager provides a unified infrastructure for mobile, physical and virtual environments. Configuration Manager also helps you to be more efficient with simplified administrative tools and improved compliance enforcement.
New features in the release candidate include:

Improved endpoint protection functionality, with integrated setup, management and reporting of System Center 2012 Endpoint Protection. (see below)
Improved application catalog design that provides a better, more responsive experience when requesting and downloading applications.
New support for Windows Embedded devices, including Windows Embedded 7 SP1, POS-Ready 7, Windows 7 Think PC, and Windows Embedded Compact 7.
Improved compliance enforcement and tracking, with the ability to create dynamic collections of baseline compliance and generate hourly compliance summaries.
Platform support for deep mobile device management of Nokia Symbian Belle devices. Pending a platform update by Nokia later this calendar year for these devices, customers will be able to try out the management of Nokia devices with Configuration Manager.

System Center 2012 Endpoint Protection (previously known as Forefront Endpoint Protection 2012) protects client and server operating systems against the latest threats using industry-leading malware detection technologies. It is built on System Center 2012 Configuration Manager, giving customers a unified infrastructure for client security and compliance management. This shared infrastructure lowers ownership costs while providing improved visibility through user-centric malware reporting and control over endpoint management and security.
New features in the release candidate include:

Support for System Center 2012 Configuration Manager, including integrated setup, management, and reporting.
Role-based management across security and operations.
Improved alerting and reporting, with near real-time and user-centric data views.
More efficient delivery of signature updates using new automatic software deployment model.

Need more information? See the System Center 2012 Configuration Manager and System Center 2012 Endpoint Protection product details pages.

Top of page

System requirements

Supported Operating Systems: Windows Server 2003 R2 x64 editions, Windows Server 2008, Windows Server 2008 R2

Site System Requirements

Site servers and site roles require 64-bit OS (distribution points are an exception)

Branch Distribution Points

Branch distribution points have been deprecated and replaced with standard distribution points that can be hosted on Configuration Manager 2012 client operating system platforms, with the exception of Windows XP Professional Service Pack 3 and Windows XP Tablet PC SP3
Standard DPs can run on Windows Server 32-bit but will not support advanced functionality

Server Operating System Requirements

Windows Server 2008 (64-bit) and Windows Server 2008 R2
Distribution points can run on Windows Server 2003

Client Operating System Requirements

Windows XP professional SP3 – x86 and Windows XP SP2 pro for 64 bit systems
Windows Vista SP2 (x86,x64)
Windows Server 2003 R2 SP2 (x86,x64)
Windows Server 2008 (x86,x64)
Windows Server 2008 R2 (x86,x64)
Windows 7 (x86,x64)

Database Requirements

SQL Server 2008 SP2 with CU 6
SQL Server Express 2008 r2 WITH SP1 and CU 3 is supported only on secondary sites
QL Reporting Services is ONLY reporting solution

For Supported Configurations information, visit http://technet.microsoft.com/en-us/library/gg682077.aspx.

Top of page

Instructions

Click the Download button next to the file most appropriate for your needs.
For System Center 2012 Configuration Manager Release Candidate use the file - ConfigMgr_2012_RC1_ENU_7678.exe

Do one of the following:
- To download the media image, click Run
- To save the download to your computer to install at a later time, click Save.
- To cancel the installation, click Cancel.
The media will be downloaded into a folder and then you can run splash.hta in the root of the folder to begin Setup.

Some useful SCCM Patch Management - Custom Reports

http://pleasepressanykey.blogspot.com/2010/08/sccm-patchmgmt-custom-reports.html

Friday, October 28, 2011

DP Package Utility – For Remove all packages from a Specific DP

With the help of this utility we can add & remove Packages from a Specific DP

http://www.myitforum.com/inc/arts/12171Setup.zip

For this Utility required .NET Framework 2.0

"+" In AutoCAD files not able to Download at client side

This can be fixed with……….

investigated this and turns out this is an IIS request filtering issue with urls containing "+" character. Basically you get a 404.11 error since the url is double encoded. The following KB article presents a workaround to set "allowDoubleEscaping" to true. Note that by default this is disabled and you need to set this explicitly.

http://support.microsoft.com/default.aspx/kb/942076

After I enabled this I was able to download files from directories containing "+" character. Can you try this out and let me know if it resolves you issue.

To resolve this problem, follow these steps.
Note After you follow these steps, the security level of the server that is running IIS may be reduced. Therefore, before you set the allowDoubleEscaping property to True, consider the risk that is involved.

Click Start, type Notepad in the Start Search box, right-click Notepad in the Programs list, and then clickRun as administrator. If you are prompted for an administrator password or for a confirmation, type your password, or click Continue.
On the File menu, click Open, type %windir%\System32\inetsrv\config\applicationHost.config in the File name box, and then click Open.
In the ApplicationHost.config file, locate the requestFiltering XML element.
Change the value of the allowDoubleEscaping property to True. To do this, use code that resembles the following example code.
```
<requestFiltering allowDoubleEscaping="true">
```
On the File menu, click Save.
Exit Notepad.

Important When you enable double escaped sequences, the security level of the server that is running IIS may be decreased.
The previous steps will directly edit the applicationHost.config file and configure this setting at the server level. You can also use the Appcmd command to configure this setting. To do this, follow these steps:

Click Start, click Run, and then type cmd in the Open box.
Type the following command, and then press ENTER:
C: CD %windir%\system32\inetsrv
Run one of the following commands:
- ```
Appcmd set config "Default Web Site" /section:system.webServer/Security/requestFiltering -allowDoubleEscaping:True
```
  Note This will configure this setting only for the "Default Web Site" by creating or editing the Web.config file in the root folder of the "Default Web Site."
- ```
appcmd set config "Default Web Site" /section:system.webServer/Security/requestFiltering -allowDoubleEscaping:True /commit:appHost
```
  Note This will configure this setting only for the "Default Web Site" in the applicationHost.config file by using a location tag.

Wake On LAN Vs OBT (Out of band management)

http://technet.microsoft.com/en-us/library/cc161828.aspx

Feature	Advantage	Disadvantage
Wake On LAN	Does not require that the site is running Configuration Manager 2007 SP1. Supported by many network adapters. UDP wake-up packets are quick to send and process. Does not require a PKI infrastructure. Does not require any changes to Active Directory Domain Services. Supported on workgroup computers, computers from another Active Directory forest, and computers in the same Active Directory forest but using a noncontiguous namespace.	Less secure solution than out of band management because it does not use authentication or encryption. If subnet-directed broadcast transmissions are used for the wake-up packets, this has the security risk of smurf attacks. For more information about securing subnet-directed broadcast transmissions with Wake On LAN, see Secure Routers for Subnet-Directed Broadcasts for Wake On LAN. Might require manual configuration on each computer for BIOS settings and adapter configuration. No confirmation that computers are woken up. Wake-up transmissions as multiple UDP packets can unnecessarily saturate available network bandwidth. Cannot wake up computers interactively. Cannot return computers to sleep state. Management features are restricted to waking up computers only.
Out of band management	More secure solution than Wake On LAN because it provides authentication and encryption using standard industry security protocols. It can also integrate with an existing PKI deployment, and the security controls can be managed independently from the product. Supports automatic centralized setup and configuration (provisioning). Established transport session for a more reliable connection and auditable connection. Computers can be woken up interactively (and restarted). Computers can be powered down interactively. Additional management capabilities, which include the following: Restarting a non-functioning computer and booting from a locally connected device or known good boot image file. Re-imaging a computer by booting from a boot image file that is located on the network or by using a PXE server. Reconfiguring the BIOS settings on a selected computer (and bypassing the BIOS password if this is supported by the BIOS manufacturer). Booting to a command-based operating system to run commands, repair utilities, or diagnostic applications (for example, upgrading the firmware or running a disk repair utility).	Requires that the site is running Configuration Manager 2007 SP1 or later. Supported only on desktop computers that have the Intel vPro chip set and a supported version of Intel Active Management Technology (Intel AMT) firmware. For more information about which AMT versions are supported, see Overview of Out of Band Management. The transport session requires more time to establish, higher processing on the server, and an increase in data transferred. Requires a PKI deployment and specific certificates. Requires an Active Directory container that is created and configured for publishing AMT-based computers. Cannot support workgroup computers, computers from another Active Directory forest, or computers from the same Active Directory forest but using a noncontiguous namespace. Might require infrastructure changes to DNS and DHCP if provisioning out of band (the client for Configuration Manager 2007 SP1 or later is not installed).

Feature

Advantage

Disadvantage

Wake On LAN

Does not require that the site is running Configuration Manager 2007 SP1.

Supported by many network adapters.

UDP wake-up packets are quick to send and process.

Does not require a PKI infrastructure.

Does not require any changes to Active Directory Domain Services.

Supported on workgroup computers, computers from another Active Directory forest, and computers in the same Active Directory forest but using a noncontiguous namespace.

Less secure solution than out of band management because it does not use authentication or encryption. If subnet-directed broadcast transmissions are used for the wake-up packets, this has the security risk of smurf attacks. For more information about securing subnet-directed broadcast transmissions with Wake On LAN, see Secure Routers for Subnet-Directed Broadcasts for Wake On LAN.

Might require manual configuration on each computer for BIOS settings and adapter configuration.

No confirmation that computers are woken up.

Wake-up transmissions as multiple UDP packets can unnecessarily saturate available network bandwidth.

Cannot wake up computers interactively.

Cannot return computers to sleep state.

Management features are restricted to waking up computers only.

Out of band management

More secure solution than Wake On LAN because it provides authentication and encryption using standard industry security protocols. It can also integrate with an existing PKI deployment, and the security controls can be managed independently from the product.

Supports automatic centralized setup and configuration (provisioning).

Established transport session for a more reliable connection and auditable connection.

Computers can be woken up interactively (and restarted).

Computers can be powered down interactively.

Additional management capabilities, which include the following:

Restarting a non-functioning computer and booting from a locally connected device or known good boot image file.
Re-imaging a computer by booting from a boot image file that is located on the network or by using a PXE server.
Reconfiguring the BIOS settings on a selected computer (and bypassing the BIOS password if this is supported by the BIOS manufacturer).
Booting to a command-based operating system to run commands, repair utilities, or diagnostic applications (for example, upgrading the firmware or running a disk repair utility).

Requires that the site is running Configuration Manager 2007 SP1 or later.

Supported only on desktop computers that have the Intel vPro chip set and a supported version of Intel Active Management Technology (Intel AMT) firmware. For more information about which AMT versions are supported, see Overview of Out of Band Management.

The transport session requires more time to establish, higher processing on the server, and an increase in data transferred.

Requires a PKI deployment and specific certificates.

Requires an Active Directory container that is created and configured for publishing AMT-based computers.

Cannot support workgroup computers, computers from another Active Directory forest, or computers from the same Active Directory forest but using a noncontiguous namespace.

Might require infrastructure changes to DNS and DHCP if provisioning out of band (the client for Configuration Manager 2007 SP1 or later is not installed).

Both features support waking up computers for the following scheduled activities:

Software update deployments that are configured with a deadline.
Mandatory advertisements for software distribution or a task sequence.

If you are using Wake On LAN and out of band management in the same site, you must choose how the site will wake up computers for scheduled activities that are configured for Wake On LAN. The following options are located on the Site Properties: Wake On LAN Tab:

Use power on commands if the computer supports this technology, otherwise use wake-up packets
Use power on commands only
Use wake-up packets only

Make your choice based on which feature you are using and whether the computers assigned to the site support the feature. Also take into consideration the advantages and disadvantages of both features as listed above. For example, wake-up packets are less reliable and are not secured, but power on commands take longer to establish and require more processing on the site system server that is configured with the out of band service point.

Pop-up to Postpone the advertisement or allow user to interact with advertisement

there was good Script from Jörgen Nilsson for Pop-up to Postpone the advertisement or allow user to interact with advertisement

http://ccmexec.com/2011/09/allow-the-user-to-postpone-installation-in-sccm/

Screenshots of how it will look at the client:

If the user press Cancel:

If the Process specified is running:

Usage:

Download the script: http://ccmexec.com/wp-content/uploads/2011/09/Prerun1.txt
Create a Package in SCCM containing the prerun1.vbs file
Create a Program with a command line for executing the script, for example:
“wscript.exe prerun1.vbs Excel Excel.exe”

Attribution

By accessing this Website, you indicate your acknowledgement acceptance of the following terms and conditions. These terms and conditions may change from time to time, and you agree to be bound by any such changes when posted on this Website, including its affiliates, as applicable reserves all of its rights at law and equity, The information and content displayed on this Website, including but not limited to text, graphics, logos, images, audio clips and software, is the property of Public or its licensors, as the case may be, and is protected by copyright laws. While I invite you to browse, no content or information on this Website may be downloaded, reproduced or modified in any manner without the prior written consent of me (PaddyMaddy) or as otherwise expressly provided herein.