~ Chris Sugdinis

Here are some key points to consider when managing workgroup-based ConfigMgr 2012 clients.

Distribution Points

Let's start by addressing the types of boundaries that a Configuration Manager 2012 workgroup client can and cannot use for content lookup:

- A workgroup client cannot use Active Directory Site boundaries. This is because a workgroup operating system isn't joined to a domain so the operating system itself does not have the permissions required to query Active Directory Domain Services to determine what AD site it is in. The same condition is true of a domain joined computer that is a member of a different forest.

- A workgroup client strictly uses boundaries based on IP subnet boundaries, IP address ranges and IPv6 prefixes. The only exception to this rule is an isolated case that has to do with the workgroup computer build process during Operating System Deployment (OSD).

As a result, workgroup systems cannot supply the AD Site in their boundary request and the MP does not resolve the AD Site for usage in the location stored procedure calls. Below is an example from MP_Location.log of activity related to a domain joined client that exists in the boundaries of an AD Site:

MP_GetContentDPInfoUnprotected (PR100002,1,PR1,SMSPackage,00000000,CWS-Contoso.com,CWS-Contoso.com,<ClientLocationInfo LocationType="SMSPackage" DistributeOnDemand="0" UseAzure="0" AllowWUMU="0" UseProtected="0" AllowCaching="0" BranchDPFlags="0" UseInternetDP="0" AllowHTTP="1" AllowSMB="1" AllowMulticast="1"><ADSite Name="DEFAULT-FIRST-SITE-NAME"/><Forest Name="CWS-Contoso.com"/><Domain Name="CWS-Contoso.com"/><IPAddresses><IPAddress SubnetAddress="192.168.1.0" Address="192.168.1.202"/></IPAddresses></ClientLocationInfo>)

Next is similar MP_Location.log activity from the same client a few minutes later after removing the client from the domain. The AD Site Name is no longer returned and all content location requests are determined based on IP Subnet or IP Range data alone:

MP_GetContentDPInfoUnprotected (PR100002,1,PR1,SMSPackage,00000000,,,<ClientLocationInfo LocationType="SMSPackage" DistributeOnDemand="0" UseAzure="0" AllowWUMU="0" UseProtected="0" AllowCaching="0" BranchDPFlags="0" UseInternetDP="0" AllowHTTP="1" AllowSMB="1" AllowMulticast="1"><ADSite Name=""/><Forest Name=""/><Domain Name=""/><IPAddresses><IPAddress SubnetAddress="192.168.1.0" Address="192.168.1.202"/></IPAddresses></ClientLocationInfo>)

When looking at the properties of a workstation client, the Active Directory Site Name property is always null even when the client is installed and the machine is in a managed AD Site boundary.  

The Configuration Manager agent retrieves the Active Directory Site Name from the OS if it is available and later returns that information to the site MP when making content location requests. The ConfigMgr agent also includes AD Site Name in heartbeat discovery DDR data if it exists. In both cases, for a workgroup client this property will always be null. The reason the Active Directory Site Name is null in the screenshot above is because the operating system cannot read Active Directory Domain Services to determine which AD Site that the system resides in.

If you use AD Site Boundaries as your standard boundary type but are presented with the requirement to start managing workgroup clients, you have two options:

- Leave your AD Site boundaries as-is and chose not to add the equivalent IP subnet or IP range boundaries.  If you chose this option, your workgroup clients always use your fallback DPs provided you use the Allow fallback source location for content option (see screen shot below) during deployments. This is often an acceptable situation as the percentage of workgroup clients in the environment is usually very small. 

- The other alternative is to keep your AD Site boundaries in place and change your process to allow adding the equivalent IP subnet or IP range boundary alongside your AD Site boundaries. 

If you currently use IP boundaries as a standard but you are migrating to the use of AD Site based Boundaries, then it's fine to add those equivalent AD sites to the same boundary groups. Your domain joined clients will always use the AD Site boundaries and they will ignore the IP subnet boundaries. The workgroup clients will continue to use the IP boundaries and will be unaware of the AD Site Boundaries. 

If you have a relatively small number of workgroup clients to manage and you don't have your IP Subnets or IP Ranges mapped out in your boundaries, then your clients will always pull content from a fallback DP. If this is the route that makes the most sense for you then just insure that your deployments are configured to allow fallback because the workgroup clients require it.

There is flexibility in managing workgroup clients and the choice is yours:

- You can optimize your environment for workgroup clients by insuring that you have IP Subnet or IP Range boundaries defined where applicable to your network topology. This is the ideal choice as it will allow your workgroup clients to consistently retrieve package content from the closest DPs. This may be a time consuming process but the payoff may be significant if your workgroup client population is large and your network is running at full capacity. 

- If the number of workgroup clients in your environment is small, your network is robust, and you use AD Site boundaries as a standard, you may want to consider the alternative of leaving your boundaries as-is and just standardize your workgroup client deployment process to always allow fallback.

- You can decide on a blend between of the two choices above to address key areas on your network where fallback behavior would not be a good idea on an ongoing basis.

Workgroup Client Installation

To install the client when you have no IP subnets or IP range boundaries defined for site assignment, use the following example. It is a time saver: 

Example Command line:

\\SERVER\SMS_PRI\Client\ccmsetup.exe SMSSITECODE=XYZ SMSMP=server01.corp.contoso.com DNSSUFFIX=corp.contoso.com FSP=server02 /noservice

- By specifying the SMSSITECODE and not using AUTO, you are telling ccmsetup to install the agent to a specific site regardless of how your boundaries are defined. There is no dependency or need for IP subnet or IP range based boundaries for the purposes of client installation if you are specifying the actual site code that the client will use.

- Specify the management point using the SMSMP parameter. This is an important parameter when not using auto-assignment.

- Specify the DNS suffix using the DNSSUFFIX parameter.

- Specify the Fallback Status Point using the FSP parameter.

- Specify the /noservice parameter so that the installation runs under the context of the currently logged on user for the entire duration of the installation. By default, ccmsetup.exe runs using the /service parameter even though you don't specify it. This means that ccmsetup.exe runs under the context of the local system account. The local system account of a workgroup computer does not have rights to a domain joined primary site server so if you try to run ccmsetup.exe over a network share of a domain joined primary site server, you'll be able to initiate the install under your credentials but the user context is quickly changed to that of the local system account once the installation begins. The local system account of a workgroup computer will not have rights to the network share on a primary site server to pull down additional required files and the install will fail. When viewing ccmsetup.log, there will be an installation failure similar to "Source folder \\cws-r2pr1\SMS_PR1\Client is invalid. Skip it". Below is a more detailed snippet from ccmsetup.log that shows the entire failure when the /noservice parameter isn't specified: 

Command line: "C:\WINDOWS\ccmsetup\ccmsetup.exe" /runservice /source:"\\cws-r2pr1\SMS_PR1\Client" "SMSSITECODE=PR1" "SMSMP=CWS-R2PR1.CWS-Contoso.com" "dnssuffix=CWS-Contoso.com" "FSP=CWS-R2PR1.CWS-Contoso.com" ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
Source folder \\cws-r2pr1\SMS_PR1\Client is invalid. Skip it. ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC) (Local System account cannot access this network share!)
SslState value: 224 ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
CCMHTTPPORT:    80 ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
CCMHTTPSPORT:    443 ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
CCMHTTPSSTATE:    224 ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
CCMHTTPSCERTNAME:     ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
Lookup MP:    CWS-R2PR1.CWS-Contoso.com ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
FSP:    CWS-R2PR1.CWS-Contoso.com ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
CCMFIRSTCERT:    1 ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
No MP or source location has been explicitly specified.  Trying to discover a valid content location... ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
Looking for MPs from AD... ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
Unexpected row count (0) retrieved from AD. ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
GetADInstallParams failed with 0x80004005 ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
Couldn't find an MP source through AD. Error 0x80004005 ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
No valid source or MP locations could be identified to download content from. Ccmsetup.exe cannot continue. ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
Failed to parse '"C:\WINDOWS\ccmsetup\ccmsetup.exe" /runservice /source:"\\cws-r2pr1\SMS_PR1\Client" "SMSSITECODE=PR1" "SMSMP=CWS-R2PR1.CWS-Contoso.com" "dnssuffix=CWS-Contoso.com" "FSP=CWS-R2PR1.CWS-Contoso.com"' with error 0x80004005 ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
Sending Fallback Status Point message to 'CWS-R2PR1.CWS-Contoso.com', STATEID='100'. ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
Failed to get client version for sending messages to FSP. Error 0x8004100e ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
Params to send FSP message '5.0.7958.1000 Deployment ' ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
State message with TopicType 800 and TopicId {C4BCA8C2-D142-4B89-86A8-2936A4ED83AC} has been sent to the FSP FSPStateMessage 6/22/2014 8:15:43 PM 3324 (0x0CFC)
Sending Fallback Status Point message to 'CWS-R2PR1.CWS-Contoso.com', STATEID='307'. ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
Failed to get client version for sending messages to FSP. Error 0x8004100e ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
Params to send FSP message '5.0.7958.1000 Deployment "C:\WINDOWS\ccmsetup\ccmsetup.exe" /runservice /source:"\\cws-r2pr1\SMS_PR1\Client" "SMSSITECODE=PR1" "SMSMP=CWS-R2PR1.CWS-Contoso.com" "dnssuffix=CWS-Contoso.com" "FSP=CWS-R2PR1.CWS-Contoso.com"' ccmsetup 6/22/2014 8:15:43 PM 3324 (0x0CFC)
State message with TopicType 800 and TopicId {899431E0-57CE-42AC-9907-312AC7FD9D48} has been sent to the FSP FSPStateMessage 6/22/2014 8:15:43 PM 3324 (0x0CFC)
CcmSetup failed with error code 0x80004005 ccmsetup 6/22/2014 8:15:43 PM 3312 (0x0CF0)

You can also work around the permissions issue by first copying all of the files from the \Inboxes\Client folder on the primary site server to the local temp folder on the workgroup client first. Then run ccmsetup.exe locally. You'll be using the default /noservice parameter even if you do not specify it and local system will have rights to the files that are now local. For best results, specify the /noservice parameter because it eliminates the extra copy step and the client gets installed faster that way.

Supernetting

Supernetting applies to domain joined computers only but it is important in the context of this topic because one might get the false impression that it may just be easier to avoid using AD Site Boundaries and keep all boundaries limited to type IP Subnet or IP range. After all, these two types of boundaries fully support both domain joined and workgroup clients equally, right? This isn't actually a good idea so here is some additional information to consider.

- The concept of supernetting allows engineers to make a single subnet entry in the properties of an AD Site that can represent literally dozens if not hundreds of individual subnet entries. This is a more efficient means to manage thousands of subnets in large environments.

- The underlying operating system on the client has logic to verify whether its IP address lands within a specific supernet, regardless of the mask listed for the supernet in the AD Site. For example, the OS can tell that a client with IP 192.168.121.100/24 falls under the AD Site that manages IP subnet 192.168.0.0/16. If there are two AD Sites defined where one site manages A true subnet of 192.168.121.100/24 and the other AD Site manages a supernet of 192.168.0.0/16, the OS is also able to determine that it actually belongs to the more restrictive 192.168.121.100/24 AD Site. For the purposes of content lookup, we can take advantage of this capability and use it to our advantage.

- When clients attempt to locate package source for a specific package, they post a request to their current MP containing the package ID, package version, the client's assigned site code, the client's IP address and calculated IP subnet. Configuration Manager does not support supernetting but most customers have supernets in their AD Site Boundary definitions as it’s a recommended best practice from a Platforms standpoint to have catch-all supernets defined in AD. 

- Configuration Manager does not support automatic site assignment (SMSSITECODE=AUTO) when using AD supernetting. Most customers specify the actual site code instead to work around this issue.

- The key area where Configuration Manager does work with supernetting is with regards to AD Site Boundaries for content location requests. This works well and is supported by the Platforms team because it is the underlying OS that determines nearest subnet match of an appropriate AD Site. The SMS Agent simply uses the AD Site name which is supplied by the client OS. This knowledge can save an engineer a significant amount of time in boundary management maintenance since the number of boundary entries required to manage a large environment can be significantly reduced if leveraging AD Sites instead of IP Subnets. For more details you can read here. 

To sum this all up:  

• If using AD Site Boundaries that contain underlying supernetted entries, you cannot use SMSSITECODE=AUTO when running ccmsetup.exe. Instead, specify the specific site code that you require (e.g SMSSITECODE=XYZ).
• AD Site Boundaries can be supernetted for the purposes of content location and this capability can significantly reduce administrative overhead managing boundaries for domain joined clients. 
• Workgroup clients cannot read AD Site Boundaries. They read IP Subnet and IP range boundaries.

For more information please see http://technet.microsoft.com/en-us/library/gg712298.aspx

Chris Sugdinis | Premier Field Engineer | Microsoft

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

ConfigMgr 2012 R2 system center 2012 r2 configuration manager

~ Rafid Ali

Hello Everyone, Rafid Ali here with a Configuration Manager support tip for you. I recently worked an interesting case where we had to configure Hardware Inventory using NOIDMIF files, and although writing customizations for customers is not something we’re able to do here in product support, we can help teach you how to do this on your own. Because of this I thought it would be a good idea to pass along some tips in the form of a step-by-step guide for the configuration of NOIDMIF for Hardware Inventory in System Center 2012 Configuration Manager.

This article is divided into four major steps:

Step 1: Introduction of NOIDMIF and IDMIF files, including the MOF and the component engaged to process it
Step 2: Server Side Configuration
Step 3: Client Side Configuration
Step 4: Processing the Hardware Inventory with NOIDMIF data

Step 1: Introduction of NOIDMIF and IDMIF files

1. The NOIDMIF and IDMIF files

NOIDMIF files can be used to add information to a client hardware inventory that is associated with a particular client device but cannot normally be collected by Configuration Manager. For example, many companies label each computer in the organization with an asset number and then catalogue them by hand. NOIDMIF inventory is automatically associated with the client device that it was collected from if you configure the Hardware Inventory in the client settings to collect NOIDMIFs. To do this you need to individually create a NOIDMIF file for each machine, and this information can be added to the Configuration Manager database while processing the Hardware Inventory and thus can be used for queries and reporting.

For information about creating NOIDMIF files see the System Center 2012 Configuration Manager SDK documentation at http://msdn.microsoft.com/en-us/library/hh948960.aspx.

IDMIF files are simply custom MIF files. IDMIF files contain a unique ID and are not associated with the computer they are collected from. IDMIF files can also be used to collect inventory data about devices that are not Configuration Manager clients. For example, we can use this collect information about a shared network printer, DVD player, photocopier or similar equipment that is not associated with a client-specific computer.

IDMIF files are identical to NOIDMIF files with these exceptions:

• IDMIF files must have a delta header that provides architecture and a unique ID. NOIDMIF files are automatically given a similar header by the system during processing on the client.

• IDMIF files must include a top-level group with the same class as the architecture being added or changed, and that group must include at least one property.

• Like NOIDMIF files, IDMIF files have key properties that must be unique. Any class that has more than one instance must have at least one key property defined, or subsequent instances overwrite previous instances.

• Removing IDMIF files from clients does not cause the associated data in the site database to be deleted during subsequent hardware inventories.

• IDMIF file information is not added to client inventory reports and the files themselves are sent across the network to be processed at the site server.

2. The MOF file
Managed Object Format (MOF) files can be used to import or extended hardware inventory classes that need to be inventoried from a Configuration Manager client computer.

3. MP_Hinv
MP_Hinv is a Management Point component that receives theinventory sent by client machines in XML format. It processes the XML file and converts it into a MIF file.

4. SMS_INVENTORY_DATA_LOADER
SMS_INVENTORY_DATA_LOADER processes the MIF file received from MP_Hinv and stores the inventory information sent by client machines in the ConfigMgr database by executing SQL stored procedures in the background.

Step 2: Server Side Configuration

First we will create the MOF and MIF Files according to a requirement specified in our example for this scenario.

We will pull the following information using NOIDMIF files from a SCCM client machine.

Department_Name
Department_Code
User_Full_Name
User_Title

The MOF for creating a Class and its Attribute is as follows:

[ SMS_Report (TRUE),
SMS_Group_Name ("Department_Information"),
SMS_Class_ID ("Department_Name")]
class Department_InformationInventory : SMS_Class_Template
{
[SMS_Report (TRUE),key ] string Department_Name;
[SMS_Report (TRUE) ] string Department_Code;
[SMS_Report (TRUE) ] string Users_Title;
[SMS_Report (TRUE) ] string User_Full_Name;
};

To create the MOF file, simply copy the lines above in red into Notepad and save the file with the extension .MOF

“Department_Information” is the Group name which you will see in the Resource explorer under Hardware.
“Department_Name” is the name of the Class.
“Highlighted” portion are Attributes whose values will be fetched up by processing the Hardware Inventory.

NOTE You can create more attributes as per your specific requirements.

Once the file is saved with a .MOF extension we need to import it. To do this, go to the console and open Client Settings, browse to Hardware Inventory and click on “Set Classes”

Then click on “Import”

Browse to the location where you have saved the .MOFfile and click Open 

Select the option “Import both Hardware Inventory Classes and Hardware Inventory Class Settings”

Once the Hardware Inventory class is imported, verify that the class is added by searching for it using its class name. By default it’s already selected but if not then select the Class. You can expand the Class to look into its Attributes as well.

After importing the MOF, be sure you enable the collection of NOIDMIF files as shown below.

Now you can verify that new tables are created regarding the above class “Department_Name” in the database.

At this point the configuration on the server side is completed so we will now move to the client side.

Step 3: Client Side Configuration

On the client side we need to create a MIF file and copy it to the required location. To do this, type the following lines into Notepad. This will create the NOIDMIF, its Class “Department_Name” and its attributes.

NOTE You need to save this file in .MIF extension.

Start Component
Name = "System_InformationInventory"
Start Group
Name = "Department_Information"
ID = 1
Class = "Department_Name"
Start Attribute
Name = "Department_Name"
ID = 1
Type = String(250)
Value = "ConfigMgr"
End Attribute
Start Attribute
Name = "Department_Code"
ID = 2
Type = String(80)
Value = "808315"
End Attribute
Start Attribute
Name = "Users_Title"
ID = 3
Type = String(250)
Value = "Admin"
End Attribute
Start Attribute
Name = "User_Full_Name"
ID = 4
Type = String(80)
Value = "Rafid_Ali"
End Attribute
End Group
End Component

The highlighted four attributes above are required as per our example.You can create more attributes to suit your specific requirements, but if you do, make sure the same Class and Attributes are created on the server side as well.

Once the .MIF file is created, copy it to the location: %Windir%\CCM\Inventory\Noidmifs

Now the client side configuration is completed.

Step 4: Processing the Hardware Inventory with NOIDMIF data

1. Run the “Machine Policy Retrieval and Evaluation Cycle” so the new policies regarding the new Hardware Inventory Classes are be received.

2. Run the “Hardware Inventory Cycle” to send the new Inventory with NOIDMIF’s data. InventoryAgent.log will show that four new attributes regarding the Class “Department_Name” need to be collected for hardware Inventory data and that info needs to be sent to server.

The next line will show that “Department_InformationInventory” does not exist, but you can ignore it.

3. Now the XML file from the client computer will be received by MP_Hinv and processed into a MIF file and sent to the SMS_INVENTORY_DATA_LOADER component (dataldr.box) for processing.

MP_Hinv.log:

4. The SMS_INVENTORY_DATA_LOADER component will receive file MIF file, process it, and then insert the data into the corresponding tables in the ConfigMgr database by running SQL stored procedures in the background.

NOTE To view the stored procedures you must enable verbose logging for the SMS_INVENTORY_DATA_LOADER component.

Dataldr.log:

5. In the ConfigMgr console, open Resource Explorer for the client computer and view the Processed NOIDMIF information. You will find a new component named “Department_Information” with its Attributes and their values under HARDWARE

NOTE All of the above results and screens shots are from my lab environment setup in a simple ConfigMgr 2012 R2 configuration. It is recommended that you perform these steps in a test environment before implementing in a production environment.

Additional Information

1. NOIDMIF files themselves are not sent to the site server during a client hardware inventory cycle. The information that is contained within the NOIDMIF file is collected and added to the client inventory report.

2. When you create a NOIDMIF file, this must be saved in an ANSI encoded format. NOIDMIF files saved in UTF-8 encoded format cannot be read by Configuration Manager.

3. The Configuration.mof file is used to define the data classes to be inventoried by the hardware inventory client agent. Data classes can be created to inventory existing or custom WMI repository data classes or registry keys present on client systems.

4. The SMS_def.mof file defines the reporting classes used by the hardware inventory client agent to determine whether or not specific client data class information is reported. Reporting classes are based on the WMI repository data classes and attributes of those classes existing on clients by default or added to them by customizing the Configuration.mof file.

5. For more information on how to import Hardware Inventory class please see the following:

http://blogs.technet.com/b/configurationmgr/archive/2010/03/25/customizing-hardware-inventory-in-configuration-manager-2007-using-noidmif-files.aspx

Rafid Ali

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

System Center 2012 R2 Configuration Manager ConfigMgr 2012 R2 ConfigMgr 2012 SP1 service pack 1

~ Larry Mosley

Every once in a while, we here in product support will get a call where someone has deployed a task sequence that formats and installs a new OS to the ‘All Systems’ collection, or to a collection that contains many computers. Please, always be vigilant and careful when targeting OSD task sequences (or any software, really) to the ‘All Systems’ collection, or any other collection with a large number of important computers in it. Configuration Manager doesn’t have an intention checker, and if you deploy a Task Sequence that does something like format the hard drive and apply an OS image, Configuration Manager will happily tell the clients to follow those instructions, wiping the disks and installing a new image to all the machines that receive the policy.

Needless to say, this can have serious consequences, and there is no ‘UNDO’ or ‘I didn’t meant to do that!’ button in Configuration Manager.

Larry Mosley| Senior Escalation Engineer | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

ConfigMgr 2007 ConfigMgr 2012 R2

Forefront Endpoint Protection 2010 clients managed by System Center Configuration Manager 2007 (ConfigMgr 2007) may appear in the “Out of Date” deployment status collection after an anti-malware platform update is installed via Microsoft Update.

This issue occurs because the “Out of Date” collection checks for the version of the 'Microsoft Forefront Endpoint Protection 2010 Server Management' entry in Add/Remove programs data, however this data is not updated by anti-malware platform updates released to Microsoft Update.

For information about a hotfix that addresses this issue please see the following article in the Microsoft Knowledge Base:

KB2975384 - Up to date Forefront Endpoint Protection 2010 clients listed in the “Out of Date” collection (http://support.microsoft.com/kb/2975384)

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

When you upgrade an enrolled Windows RT-based device to Windows 8.1 RT General Availability, all modern apps that were installed through the Company Portal app before the upgrade may not function immediately, and an "X" may be displayed on the apps tile.

This occurs because even though you can open the Company Portal app, you cannot use the apps that were installed from the Company Portal app until the device is connected to the Windows Intune service. After the device is connected, the Windows "side-loading" keys are re-provisioned and the functionality of the apps is restored.

For all the details for this issue as well as a resolution, please see the following:

KB2901698 - Some apps may not function after an enrolled Windows RT-based device is upgraded to Windows 8.1 RT General Availability (http://support.microsoft.com/kb/2901698)

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

When you upgrade from the Windows 8.1 Preview release to Windows 8.1 General Availability on a Windows RT-based device, any deployed application that you may have had on the device is removed. This problem occurs because during the upgrade of a Windows RT-based device from the Windows 8.1 Preview release to Windows 8.1 General Availability, there is no "keep settings, files, and apps" option that you can select. This causes both management ability and deployed applications to be removed from the device.

For all the details for this issue as well as a resolution, please see the following:

KB2905780 - Deployed applications are removed during upgrade to Windows 8.1 General Availability on a Windows RT-based device (http://support.microsoft.com/kb/2905780)

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

Support for Windows XP ends on April 8, 2014. After that date, Microsoft will not provide any public support for Windows XP. This includes security patches, non-security hotfixes as well as assisted support. To continue receiving assisted support and security updates you should upgrade to a more recent version of Windows. For more information see the following Microsoft website:

Support is ending for some versions of Windows

The end of support for Windows XP may affect you if you use System Center Configuration Manager because certain versions support the deployment of only certain versions of Windows. You can use Operating System Deployment (OSD) to deploy the Windows operating system and to upgrade to a newer version, however depending on the version of Windows that you want to deploy, you may have to first upgrade the version of System Center Configuration Manager that you're using. The article below provides details about which version of ConfigMgr 2007 or ConfigMgr 2012 you need in order to deploy a particular version of Windows.

KB2909893 - Which version of System Center Configuration Manager do you need to deploy a particular version of Windows? (http://support.microsoft.com/kb/2909893)

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

~ Rafid Ali

Hello Everyone, Rafid Ali here with another support tip for you on configuring a ConfigMgr 2012 reporting service point for HTTPS. I have typically seen this requirement when the ConfigMgr site is configured to only accept HTTPs client communication, so to improve reporting security, here is how to setup your reporting services point to use HTTPS as well.

Introduction to reporting in Configuration Manager

Reporting in System Center 2012 Configuration Manager provides a set of tools and resources that help you use the advanced reporting capabilities of SQL Server Reporting Services (SSRS) and the rich authoring experience that Reporting Services Report Builder provides. Reporting helps you gather, organize, and present information about users, hardware and software inventory, software updates, applications, site status, and other Configuration Manager operations in your organization. Reporting provides you with a number of predefined reports that you can use without changes, or that you can modify to meet your requirements, and you can create custom reports.

In this example, we will use a scenario where my Report Server is at a remote location hosting SSRS (SQL Server Reporting Services) and the ConfigMgr Site Database is local. However, you can have your Report Server local as well.

Requirements

A Certificate (with Server OID or Web Server Certificate) on the Report Server where SQL Reporting Service is hosted.

NOTE The Report Server instance and ConfigMgr Site Database instance can be on different servers but they must be the same version in order to communicate properly.

The Steps Involved

1. Issuing a Certificate and Enrolling it on Report Server.
2. Configuration of the Report Database and URLs
3. Installation of the Reporting Services Point role.

Step 1: Issuing a Certificate and Enrolling it on Report Server

We need a certificate (with Server OID or Web Server Certificate) on our Report Server. The ‘Subject Name’ of the Certificate should be the FQDN of Report Server as the URLs will be created using the same name. You can ask your PKI expert to provide you with this certificate on the Report Server or you can refer to the article below for information on creating, issuing and requesting the certificate.

Configure the Web Server certificate template: http://technet.microsoft.com/en-us/library/ee649187(v=WS.10).aspx

Request a Certificate: http://technet.microsoft.com/en-us/library/cc730689.aspx

To verify certificate enrollment, check the Personal Store of your Report Server and verify with the ‘Template Name’ you provided initially while issuing the certificate.

NOTE Make sure that “Issued To” has your ‘Report Server FQDN’, as the URLs will be created using this name.

Step 2: Configuration of the Report Database and URLs

Open the “Reporting Services Configuration Manager” by connecting to the correct Instance. Verify that the version of ‘Reporting Service Instance’ is the same as ‘SCCM Database Instance’. If not, upgrade the Reporting Service Instance first.

Go to “Web Service URL”. You will find that the URL is already created on Port:80 but is not active. To make it active click on “Apply”.

NOTE You need to make the URL active only if Reporting Services is not configured during installation of SQL Reporting Services.

Do the Same for “Report Manager URL”:

Next select “Database”.

NOTE If the Database is already created and configured then skip this part (Database Configuration), else proceed accordingly for configuring the Report Server Database.

In my case the Database named “ReportServer_New” is already created and configured but I am proceeding with configuration of a New Database just so that you can see how this is done.

Click on “Change Database”:

Select “Create a new report server database”:

Provide the server name where the SCCM Database instance is hosted:

Provide the name of Report Server Database you want to create. Here I have provided the name “ReportServer”:

Provide the credentials as per your environment configuration. I suggest “Local System” as a good one to use.

Finish the configuration:

Once the Report Database is created you can verify the same by opening the SQL Management Console on the Site Database Server:

NOTE You can also verify the version of ‘SQL Instance’ on which the SCCM Site Database is hosted and compare it with ‘SQL Reporting Services Instance’ hosted on the Report Server.

Now go back to “Web Service URL” to configure it for HTTPS. Click on “Advanced..”:

Remove the TCP Port 80 (HTTP) identity and add the SSL identity by clicking on “Add”:

SSL Port 443 will be already selected. Select the Web Server certificate we previously enrolled:

This will create the required HTTPS URL automatically that you can verify here:

Click OK to finish the Web Service URL configuration:

You will find that the HTTPS (Web Service) URL (https://<Report Server FQDN>:443/ReportServer) is created as per your Report Server FQDN:

Click on the URL to verify that its running and verify that it’s connecting via HTTPS:

Now do the same for Report Manager URL:

You will find that the HTTPS Report Manager URL (https://<Report Server FQDN>:443/Reports) is created as per your Report Server FQDN:

Step 3: Installation of the Reporting Services Point role

Go ahead and add the Reporting Service role on the Report Server hosting the SQL Reporting Services.

IMPORTANT While adding the role make sure that you specify the following:

• “SCCM Site Database Server Name” at ‘Site Database Server Name’ (Example: PRI.contoso.com)
• “SCCM Site Database Name” at ‘Database Name’ (Example: CM_MUM)
• “Reporting Service Instance Name” at ‘Reporting Services Server Instance’ (Example: MSSQLSERVER)
• Set the “User Name”

Below is the screen shot for the same:

Once the role is added you can verify the initiation of role installation and start of the Bootstrap Service in Sitecomp.log. Do this by looking at the Site System name (i.e. Report Server):

Verify that the role was added successfully by looking in SRSRPsetup.log on the Site System (located at \\<Drive>\SMS\Logs):

If the role installation is successful, look in the SRSRP.log created at the same location and verify the HTTPS URL you created. Also verify the SSRS Instance Version as well as the creation of the Source Folder and Data Source:

Once all of the above things are verified and configured, it will start deploying Reports and creating respective folders of those reports:

Once all the reports are deployed it will check the SRS Web Service health and keep checking at regular intervals:

Once all of the reports deployed successfully, you can verify the URLs in the ConfigMgr 2012 console as well:

Now you can go ahead and start running the reports from the ConfigMgr 2012 console using HTTPS mode by using the HTTPS URL.

Summary

In Step 1 we issued a Web Server certificate and enrolled it on the Report Server, with the configuration of the URLs being the most important step that you need to focus on. In Step 2 we configured the URLs and verified that they were running properly, and that the Report Server Database was created successfully under the Master Database. Once the SSRS configuration was complete we then proceeded towards Steps 3 for the configuration of Reporting Service Point Role on our Site System (hosting the SSRS). We closely looked into the desired inputs (with examples) in the wizard while adding the role, we went through the logs and verified the configuration settings that Configuration Manager 2012 verifies before installing the Role, then we verified the successful installation of role and deployment of reports on Report Server.

Additional Information

1. Refer to the following article for more information on configuring the Report Server: http://msdn.microsoft.com/en-us/library/aa545752(v=CS.70).aspx

2. Refer to the following article for more information on configuring SSRS URLs: http://msdn.microsoft.com/en-us/library/ms159261.aspx

3. See the following for more information on configuring a Report Server Database Connection (SSRS Configuration Manager): http://msdn.microsoft.com/en-us/library/ms159133.aspx

Rafid Ali

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

This month we released a document series that serves as a best practice guide for using Task Sequences in System Center 2012 R2 Configuration Manager. The scenario is presented as a case study for the fictitious company named Fourth Coffee and goes through the follow scenarios of using Task Sequences in ConfigMgr 2012 R2:

• Bare Metal Task Sequence and examination of steps
• Lessons learned from the bare metal process
• Create Computer Refresh Task Sequence Wizard and examination of the steps
• Lessons learned from the Create Computer Refresh Task Sequence

There are five parts in all and you can find them here:

Sequences in System Center 2012 Configuration Manager R2

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

~ Eric Ellis

Hi everyone, Eric Ellis here with a quick support tip for you about how a bad report in System Center Configuration Manager 2007 can potentially cause the admin console to crash. 

The last time I ran into this, the customer was using ConfigMgr 2007 R3 in their environment, and when they would run the "Compliance 1 - Overall Compliance" report in the ConfigMgr console it caused the console to crash. The same behavior didn’t happen with any of the other reports, nor did it occur when running the same report via the SQL Server Reporting Services URL.

The details of the console crash included the following:

An error occurred in ConfigMgr. The ConfigMgr console will continue to function, however you should save your work and restart the console. After restarting the console, verify that your last configurations have been applied.

A related SMSAdminUI.log contained the following entry:

The report definition is not valid or supported by this version of Reporting Services. This could be the result of publishing a report definition of a later version of Reporting Services, or that the report definition contains XML that is not well-formed or the XML is not valid based on the Report Definition schema. Details: The element 'TablixMembers' in namespace 'http://schemas.microsoft.com/sqlserver/reporting/2010/01/reportdefinition' has incomplete content. List of possible elements expected: 'TablixMember' in namespace 'http://schemas.microsoft.com/sqlserver/reporting/2010/01/reportdefinition'.

What we ultimately discovered was that the default report had been edited in a later version of SSRS Report Builder than is supported by ConfigMgr 2007. This introduced schema differences to the RDL file, thus causing the console to crash.

The Configuration Manager product team touches on this issue here:

FAQ - SQL Reporting Services Integration with System Center Configuration Manager 2007 R2

The article linked above states the following:

“Partial support for authoring and running reports in a SQL Server 2008 environment
- The Configuration Manager 2007 R2 release uses the SQL Reporting Services 2005 report schema underneath and hence reports authored using Business Development Studio 2008 (as bundled with SQL Server 2008) and Report Builder 2.0 will not run from the Configuration Manager 2007 R2 administration console. However you can author reports using any of the tools available with SQL Reporting Services 2008 and can run these reports from the SQL Reporting Services Web UI directly.”

If you’re unsure whether this is your issue, you can easily tell by looking at the RDL file itself. For example, here’s the relevant snippet from a correct, working RDL file:

<?xml version="1.0"?><Report Name="Compliance 1 - Overall Compliance" xmlns="http://schemas.microsoft.com/sqlserver/reporting/2005/01/reportdefinition">

Here’s an example of one edited using a later version:

<?xml version="1.0" encoding="utf-8"?><Report xmlns:rd="http://schemas.microsoft.com/SQLServer/reporting/reportdesigner" xmlns:cl="http://schemas.microsoft.com/sqlserver/reporting/2010/01/componentdefinition" xmlns="http://schemas.microsoft.com/sqlserver/reporting/2010/01/reportdefinition">

So with this in mind, that gives us three possible ways to go forward:

Option 1: View the reports in question via the SQL Server Reporting Services Report Manager.

Option 2: Replace the modified copy of the report in question using the following steps:

a. Obtain an unmodified/default copy of the report file (*.RDL).

b. Open SSRS Report Manager and navigate to the location of the report.

c. Make a copy of the report by clicking the pull down menu associated to this report, clicking on the “Download” option, and saving the copy to a desired location, as shown below.

d. Overwrite the existing copy of the report in SSRS Report Manager:

- Open SSRS Report Manager and navigate to the location of the report.
- Click on the pull down menu associated with the report and click on the “Manage” option.
- In the report Properties window, click the “Replace” button.

- Click the Browse button, navigate to the location of the unmodified/default copy of the report file, click OK, and Apply.

- Click the “Home” link to return to the home page of the Report Manager.
- Browse to the location of the report in the Report Manager, run the report, and ensure that it functions properly.
- If running the report in Report Manager is successful, run the report from within the ConfigMgr 2007 console to ensure that the report is rendered without crashing.

Option 3: If the edits made to the report are required, and you need to be able to open the modified reports in the ConfigMgr 2007 console, modifications to the report must be done within the SSRS 2005 edition of Report Builder. Once this has been done, upload the SSRS 2005 version of the report into the SSRS 2008R2 Report Manager and override the previous version of the report using steps similar to those in Option 2 above.

Eric Ellis| Senior Support Escalation Engineer | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

When you try to install an application package (.cmmac file) that is larger than 4 gigabytes (GB) on an Apple Mac by using the ConfigMgr 2007 or ConfigMgr 2012 client, the package cannot be extracted. This issue occurs because the unzip tool located in "/usr/bin/unzip" does not support extracting files that are larger than 4 GB, even though the inbox ZIP utility can create a compressed (.zip) file that is larger than 4 GB. As of 8/19/2014, this is a known issue of using the System Center Configuration Manager client on a Mac. The issue will be fixed when an updated unzip tool that supports large files is available for Mac.

For all the details and the latest information regarding this issue, please see the following:

KB2990325 - You cannot install applications larger than 4 GB on a Mac by using the System Center Configuration Manager client (http://support.microsoft.com/kb/2990325)

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

~ Radu Tomoiaga | Support Engineer

This article is a follow up to my original post titled How to determine who deleted what objects in the Configuration Manager console (http://blogs.technet.com/b/configurationmgr/archive/2013/10/01/how-to-determine-who-deleted-what-objects-in-the-configuration-manager-console.aspx). As in System Center 2012 Configuration Manager (ConfigMgr 2012), we have only SQL Reporting Services for the reporting component and I decided to write this article to fill in the blanks that were left behind from that first post.

Once in a while you may face an issue where you discover that some clients are missing in the Configuration Manager console and you’re not able to figure out what happened. You suspect that one of the ConfigMgr admins might have accidentally removed them but how can you figure out which one did what? Here’s a tip showing how you might be able to figure this out.

As in my original post, we want to look for a status message ID of 30066 or 30067. These mean that a user has either deleted a resource or all resources from a collection.

To do this we need to create a new report in Configuration Manager 2012 and we will use a custom SQL query to do it.

The SQL query is below:

SELECT     TOP (100) PERCENT dbo.v_StatMsgAttributes.AttributeValue AS 'User', dbo.v_StatusMessage.MessageID AS 'has deleted', dbo.v_StatMsgInsStrings.InsStrValue AS 'this computer', dbo.v_StatusMessage.RecordID , dbo.v_StatMsgAttributes.AttributeTime as 'on' FROM         dbo.v_StatusMessage INNER JOIN  dbo.v_StatMsgInsStrings ON dbo.v_StatusMessage.RecordID = dbo.v_StatMsgInsStrings.RecordID INNER JOIN dbo.v_StatMsgAttributes ON dbo.v_StatMsgInsStrings.RecordID = dbo.v_StatMsgAttributes.RecordID WHERE     ((dbo.v_StatusMessage.MessageID = 30066) OR (dbo.v_StatusMessage.MessageID = 30067))  AND (dbo.v_StatMsgInsStrings.InsStrValue LIKE @variable ) and (dbo.v_StatMsgInsStrings.InsStrIndex='2') ORDER BY 'this computer' DESC

We need to create a new report that will use the query above and it will look something like this:

When running the report we need to provide a search string which is the computer name of the client or clients that are missing:

This will show you the user name and the record they deleted. Below is another example with a % wildcard (which means all).

Hope this helps!

Radu Tomoiaga | Support Engineer | Microsoft

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

~ Jagat Singh Kathiar

Hi folks, Jagat Singh Kathiar here from the Configuration Manager team with another support tip for you. I came across this issue a while ago where a System Center 2012 Configuration Manager (ConfigMgr 2012) Management Point was configured for HTTPS and it was failing to do its health check. When we look in MPcontrol.log we found the following:

Failed in CertStrToName(...) API: 0x80092023      SMS_MP_CONTROL_MANAGER              8/29/2014 10:07:29 AM  20132 (0x4EA4)

The Error 500 stated above is pretty generic but if you look closely it is clearly stating that it is failing in GetCertificateBySelectingCriteria. This means we probably have an issue with our certificate so here’s how you can verify that:

Connect to the ConfigMgr console and go to Administration –> Site configuration –> Site properties and select the Client Computer Communication tab, then click on Modify and check the Clients Certificate Selection Settings. In this case, we found that the certificate selection criteria was set to use a certificate with a certain Subject name and SAN field although there were no matching certificates present in the personal computer store.

To resolve the problem, we set the client certificate selection criteria to the default which is Client authentication capability and chose the radio button for Select the certificate with the longest validity period as shown below.

Default settings are shown above

IMPORTANT Changing these settings will apply them to every single client assigned to your site which may result in unintended consequences. Please ensure that you are fully aware of how this change may impact your environment before implementing this solution. 

Jagat Singh Kathiar| Sr. Technical Lead | Microsoft

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/