Network Access Protection (NAP) with System Center 2012 Configuration Manager

 I am going to document (with screen shots) how to integrate System Center 2012 Configuration Manager with Microsoft Network Access Protection (NAP).  All Servers are running Windows Server 2012 and clients are Windows 8.

There are different ways to implement NAP:

• IPsec Enforcement Configuration            

• 802.1X Enforcement Configuration            

• VPN Enforcement Configuration            

• DHCP Enforcement Configuration            

• No Enforcement Configuration   

I setup a basic NAP implementation using DHCP Enforcement. The NAP DHCP server is running on a Windows Server 2012 Domain Controller with the DHCP server role installed along with Network Policy and Access Services Role. The NAP DHCP server restricts noncompliant client access by providing a limited IP address configuration to computers that do not meet health requirements. A limited access configuration has a subnet mask of 255.255.255.255 and no default gateway.         

I will not go into detail on how to setup NAP, but here is a screen shot on how to enable it on DHCP.  I also set a DHCP Policy to enable User Class for NAP and MAC Filter so I can target only a couple of machines in my lab environment.

Now for Configuration Manager integration...

Step 1:Install System Health Validator Point:

A System Health Validator point validates Configuration Manager Network Access Protection (NAP) policies. It must be installed on a NAP health policy server. In my lab environment, I installed the System Health Validator Point on my Domain Control that is also my DHCP and Network Policy and Access Server.

There are no properties to configure for this site system role.  Configure the System Health Validator point component configuration for settings that apply to all System Health Validator points in the site.

 Step 2: Enable Network Access Protection on clients:

I created a separate Client Agent Policy that enables NAP.  Then deployed it only to my Windows 8 Systems Collection. Here is a screen shot:

Step 3: Configure Site Component (optional)

There are a few Component properties that can be adjusted: Active Directory query interval (minutes), Statement of health time validation (hours) and Designate an Active Directory forest in different.  In my lab environment, I left the default settings.  Screen shot below:

Step 4 (Final Step): Enable Software Updates for NAP Evaluation

Select 1 or more Software Updates (hold down control key) from a Software Update Group and/or Software Update Deployment Package, click the NAP Evaluation Tab and select to enable NAP Evaluation.

I then deployed Software Updates to Windows 8 System Collection.  I marked the Deployment as Available to help with Screen Shots and Demos from the Client Side.

Windows 8 Client experience...

 On the Windows Client system, I setup the Network Access Protection Service to Automatic and started the service.  I have enabled Windows Security Health Agent (SHA) to check the following:

Firewall Settings

• A firewall is enabled for all network connections

 Antivirus Settings

• An antivirus application is on
• Antivirus is up to date

 Spyware Protection Settings

• An antispyware application is on
• Antispyware is up to date

I did NOT enable the following (these will be handled by System Center 2012 Configuration Manager):

Automatic Updates Settings

Security Updates Settings

These settings are configured on the Network Policy Server, screen shot below:

 I have enabled Configuration Manager 2012 System Health Agent (SHA) to check the following:

Software Updates:

• Security Update for Microsoft Windows (KB2830290)
• Security Update for Microsoft Windows (KB2829361)
• Adobe Reader 10.1.7 Update*
• Adobe Flash Player 32-bit/64-bit ActiveX 11.7.700.202*

 *I have installed and configured System Center Updates Publisher 2011 to integrate with Configuration Manager.  Now I am able to add 3rd Party Updates to the NAP Policy (i.e. Adobe Reader, Flash, etc...)

The default settings for NAP Enforcement on Non-compliant systems is "Allow limited access". Non-compliant clients are allowed access only to a restricted network for updates.  I configured my Remediation Server Group to include Network Policy Server and Configuration Manager Server. This way, clients can still access Remediation Servers while having limited network access.

However, for demo purposes, I checked "Allow full network access" for Non-Complaint Systems.  That is why the screen shot below will show "You have full network access"

Windows Security Health Agent is unsuccessful because I have disable Windows Firewall.  You can have NAP Automatically Remediate the firewall if it is not enforced by Local or Domain Group Policy.

Configuration Manager 2012 System Health Agent is unsuccessful (non-compliant) because I uninstalled Security Update KB2830290.  The first time I logged in with NAP enabled, Configuration Manager automatically installed the Security Updates to make the client Compliant. I went back and manually removed the Update so NAP will report Non-Compliant for this screen shot.

Monitoring 

And finally, all Network Access Protection can be monitored from Configuration Manager Reporting.  You can sort by Category - Network Access Protection and there are 13 built-in reports.

I am going to detail some of the scenarios on managing Mac Computers with System Center 2012 Configuration Manager. 

Key links to get started:

• You can download the Mac Client from - http://www.microsoft.com/en-us/download/details.aspx?id=36212
• The following Mac versions are supported in this release:
• Mac OS X 10.6 (Snow Leopard)
• Mac OS X 10.7 (Lion)
• Mac OS X 10.8 (Mountain Lion)

• How to Install Clients on Mac Computers in Configuration Manager - http://technet.microsoft.com/en-us/library/jj591553.aspx which includes the following steps:
• Steps to install and configure Site Server Roles to support Mac Clients
• Management point
• Distribution point
• Enrollment point
• Enrollment proxy point
• Steps to install Client on Mac Computers
• Installing the client
• Enrolling the client
• Upgrading the client
• Uninstalling the client

Here is a screen shot of the Mac Client:

The Mac Client can be configured using Client Agents Settings: Enrollment (Default Client Settings), Computer Policy, Compliance Settings and Hardware Inventory.

Here are some of the features that Configuration Manager supports on Mac computers with screen shots:

Discovery– Discovers Mac OS X system in Active Directory and through network discovery

Hardware Inventory– Provides hardware inventory and auditing of computers running Mac OS X, including a list of installed software similar to add/remove programs for Windows systems.

Settings Management– Ensures computers running Mac OS X comply with company policies using scripts and preference list management.

This is an example and screen shots for Detecting if Security Update is applied. Create necessary Compliance Items, add them to a Baseline, then deploy Baseline to a Mac Collection(s).

Image below is a screen shot of Configuration Item Setting to detect if Security Update 2013-001 (Lion) is installed. You can get the Application ID from Package or get Application ID and Key from the installation XML file using pkgutil command.

Configuration Item Rule to report if Security Update 2013-001 (Lion) is NOT installed and create a Noncompliance Severity Warning for Reporting.

I also created Compliance Settings to detect if System Center 2012 Endpoint Protection for Mac is installed and another to detect if it is running.  You can create Compliance for just about anything using a Shell Script and/or Preference List.

Application Deployment– Distributes required software via app model.

To create an application, you have to run the CMAppUtil on a Mac Computer to create the .cmmac file.  In my example, I created an Application package for System Center 2012 Endpoint Protection.  Once the package is created, you can import it using Application Model in Configuration Manager Console.

Configuration Manager does not support the deployment of Mac applications to users; these deployments must be to a device.  For more information on deploying Software to Mac Computers, please visit How to Create and Deploy Applications for Mac Computersin Configuration Manager - http://technet.microsoft.com/en-us/library/jj687950.aspx

You can create a Device Collection based on Operating System by using the following: Mac OS X%, Mac OS X 10.7%, or ClientEdition = 5 in your query.

Here is a picture of what the Mac User will see when deploying software:

Software Updates Management– Distributes patches utilizing Software Distribution and Settings management features.

There are a couple of way to accomplish this.  Create the software update packages using CMAppUtil, import them into Configuration Manager Application Model and then use Compliance Settings to detect if they are installed and remediate if desired.

Another option is to use the built-in command softwareupdate on Mac Computers.

NOTE: I have not finished testing this, but this is what I am targeting...

You can use a Discovery Shell Script to run softwareupdate -l | grep 'update' - (Update - the script is taking too long and timing out, set the script to run on a set schedule and not during the client connect).

and

Then use a Remediation Shell Script to run softwareupdate -i -a (or other appropriate switched).

Finally, set the Compliance Rule to look for The value returned by the specified script: Contains "No new software available"

Reporting - You can report and monitor all the features listed above using standard reports and built-in monitoring tools in Configuration Manager Console.

Internet-Based Client Management - Internet-based client management allows you to manage Mac clients when they are not connected to your company network but have a standard Internet connection.

Log Files - Log file for Configuration Manager client for Mac computers records information in the following locations:

 Additionally, the log file SMS_DM.log on the site system server records communication between Mac computers and the management point that is enabled for mobile devices and Mac computers.

The Microsoft Desktop Optimization Pack (MDOP) is a portfolio of technologies available as a subscription for Software Assurance customers. MDOP helps to improve compatibility and management, reduce support costs, improve asset management, and improve policy control.

Here is a list of the latest MDOP Technologies and supported client operating systems.  I am only listing the last two versions of each product and not defining the service pack level requirements for each client.

Microsoft BitLocker Administration and Monitoring (MBAM) provides an administrative interface to enterprise-wide BitLocker drive encryption.

Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 provides a simplified administrative interface that you can use to manage BitLocker drive encryption. In BitLocker Administration and Monitoring 2.0, you can select BitLocker drive encryption policy options that are appropriate for your enterprise, and then use them to monitor client compliance with those policies. You can also report on the encryption status of an individual computer and on the enterprise as a whole. In addition, you can access recovery key information when users forget their PIN or password or when their BIOS or boot record changes.

MBAM 2.0 supports Windows 7 and Windows 8

MBAM 1.0 supports Windows 7

Microsoft Application Virtualization (App-V) transforms applications into centrally managed services that are never installed and don’t conflict with other applications.

With App-V 5.0, virtual applications work more like traditionally installed applications. Virtual Applications leverage Windows standards for a consistent user experience. Businesses can connect separately packaged App-V applications, enabling them to communicate with each other and with traditionally installed applications. This gives businesses the best of both worlds, providing isolation – reducing conflict and time spent regression testing – yet allowing applications to interact and communicate when needed. App-V integrates with System Center Configuration Manager, so you can manage virtual and physical applications.

App-V 5.0 supports Windows 7 and Windows 8

App-V 4.6 supports Windows XP, Windows Vista and Windows 7 

Microsoft User Experience Virtualization (UE-V) captures and centralizes application settings and Windows operating system settings for the user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions.

UE-V roams the operating system experience for Windows 7 and Windows 8, providing the consistent look and feel that users expect. UE-V helps retain the application experience without having to reconfigure applications when a user logs in from a different Windows instance —regardless of how the application is delivered or whether it is a rich desktop or virtual desktop session. Smart synchronization policies determine when and where to synch application and OS settings, helping ensure seamless personalization and quick loading.

UE-V 1.0 supports Windows 7, Windows 8, Server 2008 R2 and Server 2012

Microsoft Diagnostics and Recovery Toolset (DaRT) helps troubleshoot and repair Windows-based desktops.

The toolset helps IT professionals quickly respond to and resolve user issues onsite or remotely. It also helps your IT staff work more quickly and simplifies helpdesk support, reducing your overall support costs as well as lost productivity caused by downtime.

DaRT 8.0 supports Windows 8 and Windows Server 2012.

DaRT 7.0 supports Windows 7 and Windows Server 2008 R2.

Microsoft Advanced Group Policy Management (AGPM) extends the capabilities of the Group Policy Management Console (GPMC) to provide change control and improved management.

AGPM provides a more secure archive for controlling changes to GPOs by letting IT develop, review, and modify GPOs without affecting employee desktops. By acting as an extension to the Active Directory management console and providing granular administration, AGPM enables your staff to have much greater control over how edits are made and applied, resulting in a much richer level of PC manageability.

AGPM 4.0 supports Windows Vista, Windows 7, Windows 8, Server 2008, Server 2008 R2 and Server 2012

AGPM 3.0 supports Windows Vista and Windows Server 2008.

 Microsoft Enterprise Desktop Virtualization (MED-V) uses Microsoft Virtual PC to provide an enterprise solution for desktop virtualization.

MED-V 2.0 supports Windows 7.

MED-V 1.0 supports Windows Vista and Windows XP.

Posted for Kevin Saye…

Reporting on Visual Studio License, via System Center Configuration Manager 2012

I recently had a request to report on the number of Visual Studio installs in a customer environment. Honestly, the customer did not have a full understanding of how many and where it was installed. Luckily, the customer had System Center Configuration Manager 2012 installed, so this was a snap.

I was asked "Kevin, how can I report on where it is installed?"

Answer: "Simple, write a report that shows only what you want. What do you want?"

Next question: "Umm, machine name, version of Visual Studio, User and OS".

Next Answer: "Great, do these 8 steps…."

Step 1.    Goto your Configuration Manager Reports site: http://servername/Reports and click "Report Builder"

Step 2.    Create a Table Report:

Step 3.    Chose the dataset that matches your Configuration Manager install:

Step 4.    Click the "Edit as Text" and type in the following query. (See appendix for a copy and paste of the query)

Step 5.    Set the "ProductName" as the Row Group and all others as Values.

Step 6.    Resize the report and title it as you like.

Step 7.    Save the report (rdl file). I saved mine directly in the "Software – Companies and Products" folder in the System Center directory.

Step 8.    Simply run the newly published report to see the results. You can also export to Excel here to slice and dice as you wish.

Appendix:

select distinct P.DisplayName0 as ProductName,

    P.InstallDate0 as InstallDate,

    S.Netbios_Name0 as ComputerName,

    S.User_Name0 as LastUser,

    S.Operating_System_Name_and0 as OperatingSystem,

    S.Last_Logon_Timestamp0 as LastSeen

from [dbo].[v_Add_Remove_Programs] as P,

    [dbo].[v_R_System] as S

where

    S.ResourceID = P.ResourceID

    and

    (P.DisplayName0 like 'Microsoft Visual Studio %Premium%'

    or P.DisplayName0 like 'Microsoft Visual Studio %Ultimate%'

    or P.DisplayName0 like 'Microsoft Visual Studio %Professional%'

    or P.DisplayName0 like 'Microsoft Visual Studio %Express%' )

    and P.InstallDate0 is not null

order by S.Netbios_Name0

In this blog I will detail how to perform the following with screenshots:

• Create an Office 365 App-V 5.0 Package
• Import Office Package in Configuration Manager
• Deploy Office Package with Configuration Manager
• Update Office Package with Configuration Manager

Everything is running in Hyper-V on Windows Server 2012, Configuration Manager 2012 and Windows 8 clients. This blog is for people who are experienced with Configuration Manager 2012 and Application Virtualization.

Step 1: Office Deployment Tool for Click-to-Run 

Office Deployment Tool for Click-to-Run can be downloaded from - http://www.microsoft.com/en-us/download/details.aspx?id=36778

The Office Deployment Tool allows the administrator to customize and manage Office 365 Click-to-Run deployments. This tool will help administrators to manage installations sources, product/language combinations, and deployment configuration options for Office Click-to-Run.

Note: I am using Version 1; Date Published: 2/14/2013

When you download and run the Office Deployment Tool, it will ask you where to extract the files - I picked C:\Temp\Office\DeploymentTool

There will be 2 files in this directory: Configuration.xml and Setup.exe

Office Deployment Tool Setup runs the following tasks:

• Setup /Download - Downloads files to create an Office 15 installation
• Setup /Configure - Adds, removes, or configures an Office 15 installation
• Setup /Packager  - Produces an Office 15 App-V package

I made the following changes (highlighted) to default Configuration.xml file:

<Configuration>

    <Add SourcePath="C:\Temp\Office\Download" OfficeClientEdition="32" >
    <Product ID="O365ProPlusRetail">
      <Language ID="en-us" />
    </Product>
    <Product ID="VisioProRetail">
      <Language ID="en-us" />
    </Product>
  </Add>  -->

  <!--  <Updates Enabled="TRUE" UpdatePath="\\Server\Share\Office\" /> -->

  <Display Level="None" AcceptEULA="TRUE" />  -->

  <Logging Name="OfficeSetup.txt" Path="%temp%" />  -->

  <Property Name="AUTOACTIVATE" Value="1" />  -->

</Configuration>

 Download: From a Command Prompt (Admin) - run the following command from C:\Temp\Office\DeploymentTool\ folder: Setup /Download Configuration.xml

This will download Click-To-Run source files for Office 365 to C:\Office\Download.  Then we will use these files to create an installation. 

Configure: We are going to skip the Configure piece and go straight to creating the App-V Package.  We will do some Configuration once the App-V Package is imported into Configuration Manager.

Packager: Now we have the Source Files downloaded, we can create the App-V package.

Using a Command Prompt (Admin) - run the following command from C:\Temp\Office\DeploymentTool\ folder: Setup /Packager  Configuration.xml C:\Office\App-V

This will create the App-V Package for Office 365 in the target folder C:\Office\App-V 

This is a screenshot during the creation:

Now we have an App-V Package to import into Configuration Manager.

For more information on customizing Click-To-Run, please visit the following links:

Office Deployment Tool for Click-to-Run - http://technet.microsoft.com/en-us/library/jj219422(v=office.15)

Reference for Click-to-Run configuration.xml file - http://technet.microsoft.com/en-us/library/jj219426

Step 2: Import App-V Package into Configuration Manager 2012

Copy the App-V Package to the Configuration Manager server.  Launch Configuration Manager Console - Select Software Library - Right Click Applications Node and choose Create Application

I select Microsoft Application Virtualization 5 as the Type and use a UNC Path to the Office 365 .appv file

This is a screenshot of the Imported Information

I named the Application: Office 365 ProPlus (April 2013) and filled in most of the other optional information.

You can complete the Wizard by Accepting the Defaults.

Now we have imported the Office 365 ProPlus Package into Configuration Manager Application Model.  Now it is time to Configure the Package.

Step 3: Configure Office 365 App-V Application

I created two App-V 5 Deployment Types:

• Primary Device(s) which Publishes all popular items: Excel, PowerPoint, Word, SkyDrive Pro, Lync, Access, Outlook, etc...
• Non-Primary Devices which only Publishes Excel, PowerPoint and Word.

Note that Primary Device is 1st in the Priority List.

I set the Publishing and Requirements for Primary Device using the Tabs shown below:

I did not set Requirements for Non-Primary Device Deployment since I only have 2 Deployment Types and it is last on the list. I did configure the Publishing Tab to only include Excel, Word and PowerPoint.  During an installation, Configuration Manager will check 1st Deployment and see if machine is meets the requirements, if not if will continue down the list.  Therefore, if the machine is not a Primary Device, then it will fall back to Priority 2 Deployment Type and only Publish the three applications listed.

You can be more elaborate with the Deployment Types / Publishing / Requirements. We could add another Deployment that only applies to Windows 7 or 8 Machines that are Primary Devices, and those can have a separate selection of Application to Publish.  We could make those Deployment Types Priority 1 and 2 and Push the Non-Primary Device Deployment to Priority 3. 

You can also set Dependencies where the Application Installation will check for the appropriate App-V 5.0 Client and Service Pack level and if desired, install any missing Dependencies.

Now our Application and Deployment Types are set and we are ready to Deploy Office 365 Click-to-Run...

Step 4: Deploy Office 365 with Configuration Manager

From the Applications Node, Right Click Office 365 Application and Choose Deploy - see screen shot below

I want this application to show up on the Application Catalog Website, so I chose a User Collection and made the Purpose Available and Checked Require Administrator Approval if Users Request this Application, but this step is not necessary.

Now the Office 365 App-V Application will show up in the Application Catalog Website - it is the last one on the screen shot below:

I installed the Office Application to two separate machines - one is my Windows 8 Primary Device and the other is not. Here is a screenshot from App-V Client on one of my Windows 8 machines.

Here is a screenshot of my Start Screen on my Windows 8 Primary Device showing all the Office applications published.

Here are the same screenshot from my Windows 8 Non Primary machine.

And now for the final step - How to Update Office 365 Click-to-Run Package.

Step 5: Updating Office 365 Click-to-Run App-V Package

Here are the "normal" steps for updating an App-V package.  However, all these steps do not apply to Office 365 Click-to-Run:

1. Copy the existing virtual application package to a clean Sequencer workstation.
2. Launch the Sequencer program and open the virtual application package for upgrade.
3. Install the desired application updates.
4. Save the new version of the package.
5. Open the Configuration Manager Admin Console to update the existing package as follows:
6. Select Software Library  Applications.
7. Select the copied version that has –copy and select Deployment Types at the bottom.
8. Right-click the deployment type and choose Update content.
9. Browse and point to the manifest.xml file in the new version of the App-V application and complete the wizard.
10. Go to the properties of the application and from the Supersedence tab, Add a Supersedence relationship for the previous application.
11. From the New Deployment Type drop-down, select the previous version of the application. Note: Do not select Uninstall check box.
12. Deploy the new version of the application to the appropriate collections.

The steps are little different for updating Office 365 App-V Package.  Follow the steps outlined at the beginning of this blog and create a new Office 365 App-V Package.  The /download switch from the Office Deployment Tool will download the latest and updated source files.  Create a new package, but name it slightly different.  I started adding the month and year to my Office 365 Packages in Configuration Manager: Office 365 ProPlus (April 2013) and Office 365 ProPlus (August 2013).  Once you have created your new package, then follow the steps for configuring Supersedence above. 

If you do not set Supersedence, the installation will remove your old package and all settings before updating.  Supersedence will retain each users settings.  See screenshot below:

This blog post covered the following steps with screenshots:

• Create a Office 365 Click-to-Run App-V 5.0 Package
• Import App-V Package into Configuration Manager
• Configure App-V Package in Configuration Manager
• Deploy App-V Package with Configuration Manager
• Update App-V Package with Configuration Manager

Clarification Notes on Office: Office 2013 is the traditional MSI based installation where you buy Office and install it on 1 machine.  Office 365 is the Cloud Solution that enables Office to be installed on 5 different devices and includes the Click-to-Run installation.  I used the Office 365 solution for creating the App-V Package and Deployment with Configuration Manager that I detailed in this blog post.

More information on the differences can be found at - http://office.microsoft.com/en-us/business/microsoft-office-365-for-business-faq-FX103030232.aspx

With the release of Windows 8.1, it is no longer required to have a Microsoft Account (aka Live ID) to run Windows Mail Client.  I will walk you through the steps (with Screenshots) on how to enable this new feature.

When you first launch the Mail Client, it will prompt you to "Switch to a Microsoft account on this PC" if you did not sign in with a Microsoft Account - see screenshot below. Customers that use domain accounts and do not use Microsoft Accounts, are still able to use Windows Mail Client with Windows 8.1.

To Turn this Feature Off, you have to Enable the following Group Policy:

Computer Configuration -> Administrative Templates -> Windows Components -> App runtime -> Allow Microsoft accounts to be optional

This does not only apply to Windows Mail Client, but other Windows Store Apps that support the feature and required a Microsoft Account.

Once that policy is enabled, you will now be prompted and able to use an Enterprise Account instead - see screenshot below:

If you do not publish your Email Server settings, Click on Show more details, then you are now able to enter your: Email Address, Server Address, Domain, Username and Password as show below.

I hope you find this Blog Post helpful when trying to setup the Windows Mail App without using a Microsoft Account.

Report: List Computers by Manufacturer and Model

SELECT SYS.Netbios_Name0, SYS.User_Name0, CSYS.Manufacturer0, CSYS.Model0  
FROM v_R_System SYS
RIGHT JOIN  v_GS_COMPUTER_SYSTEM CSYS on SYS.ResourceID = CSYS.ResourceID
ORDER BY CSYS.Manufacturer0, CSYS.Model0, SYS.Netbios_Name0

NOTE: This query only displays machines that are reporting Manufacturer and Model by using the RIGHT JOIN.

-

Here is a good KB Article on this subject - http://support.microsoft.com/default.aspx/kb/926172and http://technet.microsoft.com/en-us/library/cc732351.aspx

--

How to Configure Windows Server 2008 for Site Systems

http://technet.microsoft.com/en-us/library/cc431377.aspx

Network Diagram for Internet-Based Servers - Scenario 1 with SQL Server Replica

http://technet.microsoft.com/en-us/library/bb693632.aspx

Configuration Manager Site Capacity Planning

http://technet.microsoft.com/en-us/library/bb680869.aspx

--

These are notes from the SCUP Help File….

To configure the certificate store on the update server

1. Click Start, click Run, type MMC in the text box, and then click OK to open the Microsoft Management Console (MMC).

2. Click File, click Add/Remove Snap-in, click Add, click Certificates, click Add, select Computer account, and then click Next.

3. Select Another computer, type the name of the update server or click Browse to find the update server computer, click Finish, click Close, and then click OK.

4. Expand Certificates (update server name), expand WSUS, and then click Certificates.

5. In the results pane, right-click the desired certificate, click All Tasks, and then click Export.

6. In the Certificate Export Wizard, use the default settings to create an export file with the name and location specified in the wizard. This file must be available to the update server before proceeding to the next step.

7. Right-click Trusted Publishers, click All Tasks, and then click Import. Complete the Certificate Import Wizard using the exported file from step 6.

8. If a self-signed certificate is used, such as WSUS Publishers Self-signed, right-click Trusted Root Certification Authorities, click All Tasks, and then click Import. Complete the Certificate Import Wizard using the exported file from step 6.

9. Right-click Certificates (update server name), click Connect to another computer, enter the computer name for the Updates Publisher computer, and click OK.

10. If Updates Publisher is remote from the update server, repeat steps 7 through 9 to import the certificate to the certificate store on the Updates Publisher computer.

To configure a self-signing certificate on client computers

1. Click Start, click Run, type MMC in the text box, and then click OK to open the Microsoft Management Console (MMC).

2. Click File, click Add/Remove Snap-in, click Add, click Certificates, click Add, select Computer account, and then click Next.

3. Select Another computer, type the name of the update server or click Browse to find the update server computer, click Finish, click Close, and then click OK.

4. Expand Certificates (update server name), expand WSUS, and then click Certificates.

5. Right-click the certificate in the results pane, click All Tasks, and then click Export. Complete the Certificate Export Wizard using the default settings to create an export certificate file with the name and location specified in the wizard.

6. Use a method to add the certificate used to sign the updates catalog to each client computer that will use WUA to scan for the updates in the catalog. Add the certificate on the client computer as follows:

   • For self-signed certificates: Add the certificate to the Trusted Root Certification Authorities and Trusted Publishers certificate stores.
   • For certification authority (CA) issued certificates: Add the certificate to the Trusted Publishers certificate store.

   Note:  The WUA also checks whether the Allow signed content from intranet Microsoft update service location Group Policy setting is enabled on the local computer.

To deploy the WSUS self-signed certificate using software distribution and certutil.exe

1. Export the WSUS Publishers Self-signed certificate and public key to a directory on the local computer.

2. Copy the Certutil.exe and Certadm.dll files to the same directory as the exported files. Certutil.exe is a command-line program that is installed as part of Certificate Services in the Windows Server 2003 family and both files are installed in %windir%\system32, by default.

3. Create a software distribution package containing the files from step 1 and step 2.

4. Add a software distribution program that runs the following command-line: certutil.exe -addstore TrustedPublisher wsus.cer, where TrustedPublisher is the name of the certificate store and wsus.cer is the name of the exported certificate. For more information about certutil.exe, see the Certutil Web site on TechNet (http://go.microsoft.com/fwlink/?LinkId=108447)

5. Create an advertisement for distributing the package and program to the appropriate collection.

To configure the Group Policy to allow WUA 3.0 on computers to scan for published updates

1. Open the Group Policy Object Editor Microsoft Management Console (MMC) snap-in with a user that has the appropriate security rights to configure Group Policy.

2. Click Browse and select the domain, OU, or GPOs linked to the site where the configured Group Policy will propagate to the desired client computers. Click OK, click Finish, click Close, and then click OK.

3. Expand the selected policy setting in the console tree, expand Computer Configuration, expand Administrative Templates, expand Windows Components, and then click Windows Update.

4. In the results pane, right-click Allow signed content from intranet Microsoft update service location, click Properties, click Enabled, and then click OK.

--

These SDK Scripts can perform ad-hoc client side tasks. 

NOTE: If running on x64 machine, you must use the 32-bit version of C:\Windows\SysWoW64\cscript.exe since SCCM is a 32-bit application.

Client Component List

On Error Resume Next

    Dim oCPAppletMgr ' Control Applet manager object
    Dim oClientAction ' Individual client action
    Dim oClientActions ' A collection of client actions

    ' Get the Control Panel applet manager object.
    Set  oCPAppletMgr=CreateObject("CPApplet.CPAppletMgr")
    If err.number <> 0 Then
        Wscript.echo "Couldn't create control panel application manager"

    End If

    ' Get a collection of actions.
    Set oClientActions=oCPAppletMgr.GetClientActions
    If err.number<>0 Then
        wscript.echo "Couldn't get the client actions"
        Set oCPAppletMgr=Nothing

    End If

    ' Display each client action name and perform it.
    For Each oClientAction In oClientActions
        wscript.echo oClientAction.name
        oClientAction.PerformAction
        wscript.echo
    Next

    Set oClientActions=Nothing
    Set oCPAppletMgr=Nothing

Hardware Inventory Cycle

' Set the required variables.
    actionNameToRun = "Hardware Inventory Collection Cycle"

    ' Create the CPAppletMgr instance.
    Dim controlPanelAppletManager
    Set controlPanelAppletManager = CreateObject("CPApplet.CPAppletMgr")

    ' Get the available ClientActions object.
    Dim clientActions
    Set clientActions = controlPanelAppletManager.GetClientActions()

    ' Loop through the available client actions. Run the matching client action when it is found.
    Dim clientAction
    For Each clientAction In clientActions
        If clientAction.Name = actionNameToRun Then
            clientAction.PerformAction 
        End If
    Next
    wscript.echo "Ran: " & actionNameToRun

Software Inventory Cycle

' Set the required variables.
    actionNameToRun = "Software Inventory Collection Cycle"

    ' Create the CPAppletMgr instance.
    Dim controlPanelAppletManager
    Set controlPanelAppletManager = CreateObject("CPApplet.CPAppletMgr")

    ' Get the available client actions.
    Dim clientActions
    Set clientActions = controlPanelAppletManager.GetClientActions()

    ' Loop through the available client actions. Run the matching client action when it is found.
    Dim clientAction
    For Each clientAction In clientActions
        If clientAction.Name = actionNameToRun Then
            clientAction.PerformAction 
        End If
    Next
    wscript.echo "Ran: " & actionNameToRun

Discovery Collection Cycle

' Set the required variables.
    actionNameToRun = "Discovery Data Collection Cycle"

    ' Create the CPAppletMgr instance.
    Dim controlPanelAppletManager
    Set controlPanelAppletManager = CreateObject("CPApplet.CPAppletMgr")

    ' Get the available ClientActions object.
    Dim clientActions
    Set clientActions = controlPanelAppletManager.GetClientActions()

    ' Loop through the available client actions. Run the matching client action when it is found.
    Dim clientAction
    For Each clientAction In clientActions
        If clientAction.Name = actionNameToRun Then
            clientAction.PerformAction 
        End If
    Next
    wscript.echo "Ran: " & actionNameToRun

Machine Policy Cycle

' Set the required variables.
    actionNameToRun = "Request & Evaluate Machine Policy"

    ' Create the CPAppletMgr instance.
    Dim controlPanelAppletManager
    Set controlPanelAppletManager = CreateObject("CPApplet.CPAppletMgr")

    ' Get the available ClientActions object.
    Dim clientActions
    Set clientActions = controlPanelAppletManager.GetClientActions()

    ' Loop through the available client actions. Run the matching client action when it is found.
    Dim clientAction
    For Each clientAction In clientActions
        If clientAction.Name = actionNameToRun Then
            clientAction.PerformAction 
        End If
    Next
    wscript.echo "Ran: " & actionNameToRun

Software Metering Cycle

' Set the required variables.
    actionNameToRun = "Software Metering Usage Report Cycle"

    ' Create the CPAppletMgr instance.
    Dim controlPanelAppletManager
    Set controlPanelAppletManager = CreateObject("CPApplet.CPAppletMgr")

    ' Get the available ClientActions object.
    Dim clientActions
    Set clientActions = controlPanelAppletManager.GetClientActions()

    ' Loop through the available client actions. Run the matching client action when it is found.
    Dim clientAction
    For Each clientAction In clientActions
        If clientAction.Name = actionNameToRun Then
            clientAction.PerformAction 
        End If
    Next
    wscript.echo "Ran: " & actionNameToRun

Software Updates Evaluation Cycle

' Set the required variables.
    actionNameToRun = "Software Updates Assignments Evaluation Cycle"

    ' Create a CPAppletMgr instance.
    Dim oCPAppletMgr
    Set oCPAppletMgr = CreateObject("CPApplet.CPAppletMgr")

    ' Get the available ClientActions object.
    Dim oClientActions
    Set oClientActions = oCPAppletMgr.GetClientActions()

    ' Loop through the available client actions. Run the matching client action when it is found.
    Dim oClientAction
    For Each oClientAction In oClientActions
        If oClientAction.Name = actionNameToRun Then
            oClientAction.PerformAction 
        End If
    Next

    wscript.echo "Ran: " & actionNameToRun

Software Updates Scan Cycle

' Set the required variables.
   actionNameToRun = "Updates Source Scan Cycle"

   ' Create a CPAppletMgr instance.
   Dim oCPAppletMgr
   Set oCPAppletMgr = CreateObject("CPApplet.CPAppletMgr")

   ' Get the available ClientActions object.
   Dim oClientActions
   Set oClientActions = oCPAppletMgr.GetClientActions()

   ' Loop through the available client actions. Run the matching client action when it is found.
   Dim oClientAction
   For Each oClientAction In oClientActions
       If oClientAction.Name = actionNameToRun Then
           oClientAction.PerformAction 
       End If
   Next
   wscript.echo "Ran: " & actionNameToRun

--

Configuration Manager 2007 support for the different SQL Server versions:

SQL Server 2005:

• ConfigMgr RTM and SP1 support SQL 2005 SP2 and SP3. Currently, no hotfix is required.
• ConfigMgr R2 supports SQL 2005 SP2 and SP3, with hotfix 959975.

SQL Server 2008:

• ConfigMgr RTM supports upgrading an existing SQL 2005 site database to SQL 2008, with hotfix 955229; but does not support new installation using a SQL 2008 instance to host the site database.
• ConfigMgr SP1 supports SQL 2008, with hotfix 955262.
• ConfigMgr R2 supports SQL 2008, with hotfix 957576 and 959975

More information can be found at http://blogs.technet.com/configmgrteam/archive/2009/03/03/configuration-manager-2007-supported-sql-versions.aspx

--

Cross-Forest Communications Between Configuration Manager Sites

Data is sent between sites in a Configuration Manager 2007 hierarchy to enable central administration within a distributed model. For example, advertisements and packages flow down from a primary site to a child primary site, and inventory data from child primary sites are sent up to the central primary site. This information is sent between site servers in the hierarchy when the site communicates with a parent or child site. Data sent between sites is signed by default, and because sites in different Active Directory forests cannot automatically retrieve keys from Active Directory Domain Services, manual key exchange using the hierarchy maintenance tool (Preinst.exe) is required to configure intersite communication.

When one or more primary sites in the Configuration Manager 2007 site hierarchy are located within different Active Directory forests, an Active Directory forest trust is not required to enable site-to-site communication as long as domain user accounts are properly configured in the sender address properties for each site. If you do not configure domain user accounts as site address accounts in the sender address properties of each site, the site server computer accounts will be used. If the site server computer accounts are used as the site address accounts, all Active Directory forests must be configured for the Windows Server 2003 forest functional level and have a two-way trust to enable site-to-site communication to succeed.

Configuration Manager primary sites can be configured to span multiple Active Directory forests. It is not supported to install secondary sites in a remote Active Directory forest from their parent primary site. It is supported for a Configuration Manager 2007 site hierarchy to have primary sites or clients in a remote Active Directory forest.

--

Specify a fully qualified domain name (FQDN) for this site system on the intranet.

Enables or cancels the intranet FQDN text box, which allows you to specify an intranet FQDN for the site system.

An FQDN is required for many scenarios in Configuration Manager including the following:

• Automatic approval of trusted clients in mixed mode
• Native mode if the site system PKI certificate uses an FQDN
• Environments that have multiple domains and do not use a fully replicated WINS.

 

Configuring an FQDN is also recommended if this site system will host the default management point that will publish to Domain Name System (DNS).

 

Intranet FQDN

Enter a fully qualified domain name (FQDN) for the site system on the intranet. This can be the same FQDN as the server's network configuration, or it can be a CNAME (alias) configured on the intranet DNS.

If you use a CNAME (DNS alias) rather than the computer name as your FQDN, you might need to register this as a Kerberos service principal name (SPN), so that IIS authentication succeeds. Use the Setspn utility that ships with Windows Server support tools to register the CNAME as an SPN in Active Directory Domain Services.

---

Mark Cochrane (System Center Configuration Manager MVP) released an excellent tool to assist with your custom MOF snippet creations, RegkeyToMof.  Grab it from here: http://www.myitforum.com/inc/upload/12336RegKeyToMOF.zip

Sample to get the Registry Keys for Forefront

// configuration.mof for MS Forefront 1.0 Client Signatures
#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("MSForeFront1", NOFAIL)
[DYNPROPS]
Class MSForeFront1
{
[key] string KeyName;
String EngineVersion;
String AVSignatureVersion;
String ASSignatureVersion;
Boolean ASSignatureApplied[];
Boolean AVSignatureApplied[];
String SignatureLocation;
};
[DYNPROPS]
Instance of MSForeFront1
{
keyname="SystemCenter.fr";
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Microsoft Forefront\\Client Security\\1.0\\AM\\Signature Updates|EngineVersion"),Dynamic,Provider("RegPropProv")] EngineVersion;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Microsoft Forefront\\Client Security\\1.0\\AM\\Signature Updates|AVSignatureVersion"),Dynamic,Provider("RegPropProv")] AVSignatureVersion;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Microsoft Forefront\\Client Security\\1.0\\AM\\Signature Updates|ASSignatureVersion"),Dynamic,Provider("RegPropProv")] ASSignatureVersion;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Microsoft Forefront\\Client Security\\1.0\\AM\\Signature Updates|ASSignatureApplied"),Dynamic,Provider("RegPropProv")] ASSignatureApplied;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Microsoft Forefront\\Client Security\\1.0\\AM\\Signature Updates|AVSignatureApplied"),Dynamic,Provider("RegPropProv")] AVSignatureApplied;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Microsoft Forefront\\Client Security\\1.0\\AM\\Signature Updates|SignatureLocation"),Dynamic,Provider("RegPropProv")] SignatureLocation;
};

//sms_def.mof for MS Forefront 1.0 Client Signatures
#pragma namespace ("\\\\.\\root\\cimv2\\SMS")
#pragma deleteclass("MSForeFront1", NOFAIL)
[SMS_Report(TRUE),SMS_Group_Name("MSForeFront1"),SMS_Class_ID("CUSTOM|MSForeFront1|1.0")]
Class MSForeFront1: SMS_Class_Template
{
[SMS_Report(TRUE),key] string KeyName;
[SMS_Report(TRUE)] String EngineVersion;
[SMS_Report(TRUE)] String AVSignatureVersion;
[SMS_Report(TRUE)] String ASSignatureVersion;
[SMS_Report(FALSE)] Boolean ASSignatureApplied[];
[SMS_Report(FALSE)] Boolean AVSignatureApplied[];
[SMS_Report(FALSE)] String SignatureLocation;
};

http://blogs.technet.com/configurationmgr/archive/2009/05/11/how-to-capture-and-report-on-a-registry-setting-from-configuration-manager-clients.aspx 

This article seeks to offer a more complete solution on not only how to capture various registry settings from a client into the System Center Configuration Manager 2007 database, but to also demo how to build a sample query to report on those settings.

This sample will use a fictitious Software Application name for example purposes: "SampleAppOne"

With the following Registry Settings as an example:

[HKEY_LOCAL_MACHINE\SOFTWARE\SampleAppOne]
"Description"="Sample Application One Description"
"DisplayName"="Sample Application One"
"Enable"=dword:00000001

First import the above registry settings into your test client.

Next, make backup copies of the following files before making the changes outlined below:

X:\Program Files\Microsoft Configuration Manager\Inboxes\clifiles.src\hinv\sms_def.mof
X:\Program Files\Microsoft Configuration Manager\Inboxes\clifiles.src\hinv\configuration.mof

Where X:\ is the drive where Configuration Manager 2007 is installed.

The following settings were configured at the end of the sms_def.mof

#pragma namespace ("\\\\.\\root\\cimv2\\SMS")
#pragma deleteclass("SampleAppOne", NOFAIL)
[SMS_Report(TRUE),
SMS_Group_Name("SampleAppOne"),
SMS_Class_ID("Custom|SamepleAppOne|1.0")]
Class SamepleAppOne : SMS_Class_Template
{
  [SMS_Report(TRUE),key] string KeyName;
  [SMS_Report(TRUE)] String Description;
  [SMS_Report(TRUE)] String DisplayName;
  [SMS_Report(TRUE)] Uint32 Enable;};

The following settings were configured at the end of the configuration.mof

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("SampleAppOne", NOFAIL)

[DYNPROPS]
Class SampleAppOne
{
  [key] string KeyName;
          String Description;
          string DisplayName;
          Uint32 Enable;
};
[DYNPROPS]
Instance of SampleAppOne
{keyname="SampleAppOne";
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\SampleAppOne|Description"),
Dynamic, Provider("RegPropProv")] Description;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\SampleAppOne|DisplayName"),
Dynamic, Provider("RegPropProv")] DisplayName;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\SampleAppOne|Enable"),
Dynamic, Provider("RegPropProv")] Enable;
};

Once you have backed up and made the changes outlined above, Run mofcomp.exe on both the sms_def.mof and configuration.mof as follows:

%WINDIR%\System32\WBEM\Mofcomp.exe "X:\Program Files\Microsoft Configuration Manager\Inboxes\clifiles.src\hinv\sms_def.mof"
%WINDIR%\System32\WBEM\Mofcomp.exe "X:\Program Files\Microsoft Configuration Manager\Inboxes\clifiles.src\hinv\configuration.mof"

Where X:\ is the drive where Configuration Manager 2007 is installed.

Next we need to force Hardware Inventory up from a client to test and/or wait until the next scheduled Hardware Inventory is run. The changes made to the mof files on the server should start collecting the information from the client’s registry during the next Hardware Inventory Cycle.

In my testing, once the database was updated with the new tables from the custom Hardware Inventory (db0.SampleAppOne_data, history, etc...) I had to restart the SCCM 2007 Server for the mof changes to show up in the New Query as a selectable attribute. Once the tables start showing up in the SMS_Database, then restart the SCCM Server, and proceed to the next steps.

Now you can run a query from ConfigMgr 2007 Console to get a basic report showing Computer name, and a value from one of the registry keys for this computer as follows:

select SMS_R_System.Name, SMS_G_System_CUSTOM_SAMPLEAPPONE_1_0.Enable from  SMS_R_System inner join SMS_G_System_CUSTOM_SAMPLEAPPONE_1_0 on SMS_G_System_CUSTOM_SAMPLEAPPONE_1_0.ResourceId = SMS_R_System.ResourceId where SMS_G_System_CUSTOM_SAMPLEAPPONE_1_0.Enable = 1

This should return the computer names of any clients that have the registry setting Enable with a value = 1.

x

C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C\setup.exe /modify /Enterprise /config \\server\share\config.xml

Config.xml File:

<Configuration Product="Enterprise">
  <PIDKEY Value="11111-11111-11111-11111-1111" />
  <Display Level="Basic" CompletionNotice="Yes" SuppressModal="No" AcceptEula="Yes" />
  <Logging Type="Verbose" Path="%temp%" Template="Microsoft Office 2007 Setup.log" />
  <USERNAME Value="Name" /> 
  <COMPANYNAME Value="Company" />
  <OptionState Id="ACCESSFiles" State="Local" Children="force" />
  <OptionState Id="EXCELFiles" State="Local" Children="force" />
  <OptionState Id="PPTFiles" State="Local" Children="force" />
  <OptionState Id="WORDFiles" State="Local" Children="force" />
  <OptionState Id="SHAREDFiles" State="Local" Children="force" />
  <OptionState Id="TOOLSFiles" State="Local" Children="force" />
</Configuration>

__

http://technet.microsoft.com/en-us/library/bb693755.aspx

Features that Are Not Supported on the Internet

Not all Configuration Manager 2007 features are appropriate for the Internet, and so they are not supported when clients are managed on the Internet. The features that are not supported for Internet management typically rely on Active Directory Domain Services (which is not accessible from the Internet) or are not appropriate for a public network (such as network discovery and Wake On LAN).

The following features are not supported when clients are managed on the Internet:

• Software distribution that is targeted to users (either directly or through Microsoft Windows security groups).
• Branch distribution points (a branch distribution point cannot support Internet clients, and clients on the Internet cannot be configured as a branch distribution point).
• Client deployment over the Internet.
• Auto-site assignment.
• Network Access Protection (NAP).
• Wake On LAN.
• Operating system deployment.
• Remote control.
• Out of band management in Configuration Manager 2007 SP1.
• The client ping functionality used with the client status reporting feature in Configuration Manager 2007 R2.

Additionally, Internet-based client management does not support roaming, which allows clients to always find the closest distribution points to download content. Clients that are managed on the Internet have a fixed Internet-based management point and communicate with that management point only when they are on the Internet, and with site systems in the site that are configured for Internet-based client management.

Clients connecting over the Internet will download content from any of the Internet-based distribution points in the site, regardless of bandwidth or physical location. For this reason, you cannot configure a protected site system to support Internet-based client management.

____

You must enabled Named Pipes after installing MDT and Creating a Database.

Launch SQL Server Configuration Manager – SQL Server Network Configuration – Protocols – Named Pipes – Select Enabled.

Otherwise, you will get SQL Connection Errors.

This scenario is for companies that are using SCCM for Software Updates.

Create Group Policy Preferences to detect if SCCM Client is installed by detecting if a Local WSUS Server has been specified via the SCCM Client.  If specified, the Policy will ignore since the SCCM Client is installed.  If not specified, the Policy will add a WSUS/SUP that will install the client.

Create new Registry Item for WUServer

• Action: Create
• Hive: HKEY_LOCAL_MACHINE
• Key Path: Software\Policies\Microsoft\Windows\WindowsUpdate
• Value name: WUServer
• Value type: REG_SZ
• Value data: http://wsus

Set Item-level targeting for Registry Match

• Match type: Value exists
• Hive: HKEY_LOCAL_MACHINE
• Key path: SOFTWARE\Policies\Windows\WindowsUpdate
• Value name: WUServer
• Value type: REG_SZ
• Item Options: Is Not

Create new Registry Item for WUStatusServer

• Action: Create
• Hive: HKEY_LOCAL_MACHINE
• Key Path: Software\Policies\Microsoft\Windows\WindowsUpdate
• Value name: WUStatusServer
• Value type: REG_SZ
• Value data: http://wsus

Set Item-level targeting for Registry Match

• Match type: Value exists
• Hive: HKEY_LOCAL_MACHINE
• Key path: SOFTWARE\Policies\Windows\WindowsUpdate
• Value name: WUStatusServer
• Value type: REG_SZ
• Item Options: Is Not

Create new Registry Item for UseWUServer

• Action: Create
• Hive: HKEY_LOCAL_MACHINE
• Key Path: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
• Value name: UseWUServer
• Value type: REG_DWORD
• Value data: 1  *Decimal

Set Item-level targeting for Registry Match

• Match type: Match value data
• Hive: HKEY_LOCAL_MACHINE
• Key path: SOFTWARE\Policies\Windows\WindowsUpdate\AU
• Value name: UseWUServer
• Value type: REG_DWORD
• Value data: 1  *Decimal
• Item Options: Is Not