Image may be NSFW.
Clik here to view.
You may notice that per-computer task sequence variables that are defined for imported computers are filtered out of client policies. This prevents the variables from being read during task sequence execution. This problem does not affect per-computer variables that are defined for existing clients.
For additional details and a link to a ConfigMgr 2012 R2 hotfix that resolves this issue please see the following:
KB2907591 - Per-computer variables for imported computers are not read in System Center 2012 R2 Configuration Manager (http://support.microsoft.com/kb/2907591)
J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division
Get the latest System Center news onFacebookandTwitter:
Image may be NSFW.
Clik here to view.
Image may be NSFW.
Clik here to view.
System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm
Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/
The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/
Image may be NSFW.
Clik here to view.
This update resolves the following issues in Microsoft System Center 2012 R2 Configuration Manager.
Faulting application name: svchost.exe_WDSServer, version: 6.3.9600.16384, time stamp: 0x5215dfe3 Faulting module name: MSVCR100.dll, version: 10.0.40219.1, time stamp: 0x4d5f034a Exception code: 0xc0000005 Fault offset: 0x000000000005f61a Faulting process id: 0xae4 Faulting application start time: 0x01cec5d767184634 Faulting application path: C:\Windows\system32\svchost.exe Faulting module path: C:\Program Files\Microsoft Configuration Manager\bin\x64\MSVCR100.dll
Note This problem affects only distribution points that are installed on site servers.
For additional details and a link to a ConfigMgr 2012 R2 hotfix that resolves these issues please see the following:
KB2905002 - An update is available for the "Operating System Deployment" feature of System Center 2012 R2 Configuration Manager (http://support.microsoft.com/kb/2905002)
J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division
Get the latest System Center news onFacebookandTwitter:
Image may be NSFW.
Clik here to view.Image may be NSFW.
Clik here to view.
System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm
Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/
The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/
Image may be NSFW.
Clik here to view.
The Microsoft System Center 2012 R2 Configuration Manager Toolkit contains fifteen downloadable tools to help you manage and troubleshoot Microsoft System Center 2012 R2 Configuration Manager. The following list provides specific information about each tool in the toolkit.
Note: Items with an * are new in the R2 Toolkit and require Microsoft System Center 2012 R2 Configuration Manager for full functionality.
Client Based Tools
For all the details and a download link, please see the following:
System Center 2012 R2 Configuration Manager Toolkit
J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division
Get the latest System Center news onFacebookandTwitter:
Image may be NSFW.
Clik here to view.Image may be NSFW.
Clik here to view.
System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm
Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/
The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/
~ Prabhat Joshi
Image may be NSFW.
Clik here to view.
Hello Everyone, Prabhat Joshi here with another Configuration Manager support tip for you, this time for Internet Based Client Management (IBCM) in System Center 2012 Configuration Manager (ConfigMgr 2012).
Internet Based Client Management allows you to manage Configuration Manager clients when they are not connected to your company network but still have a standard Internet connection. This arrangement has a number of advantages, including the reduced costs of not having to run virtual private networks (VPNs) and being able to deploy software updates in a timely manner.
Because of the higher security requirements of managing client computers on a public network, Internet Based Client Management requires that the site is using certificates. This ensures that connections to the management point, software update point and distribution points are authenticated by an independent authority, and that data to and from these site systems is encrypted using Secure Sockets Layer (SSL).
1. User policies are supported when the Internet based MP can authenticate the user by using Windows authentication.
2. Task Sequences are supported for simple scripts, however just like ConfigMgr 2007, deploying an OS over the Internet is still not supported.
3. Using Microsoft Update to download required software updates rather than from an Internet based DP in their assigned site is supported.
Not all client management functionality is appropriate for the Internet; therefore they are not supported when clients are managed on the Internet. The features that are not supported for Internet management typically rely on Active Directory Domain Services or are not appropriate for a public network, such as network discovery and Wake-on-LAN (WOL).
The following features are not supported when clients are managed on the Internet:
Ø Client deployment over the Internet, such as client push and software update-based client deployment. Instead, use manual client installation.
Ø Automatic site assignment.
Ø Network Access Protection (NAP).
Ø Wake-on-LAN.
Ø Operating system deployment. However, you can deploy task sequences that do not deploy an operating system; for example, task sequences that run scripts and maintenance tasks on clients.
Ø Remote control.
Ø Out of band management.
Ø Software deployment to users, unless the Internet-based management point can authenticate the user in Active Directory Domain Services by using Windows authentication (Kerberos or NTLM). This is possible when the Internet-based management point trusts the forest where the user account resides.
Additionally, Internet-based client management does not support roaming. Roaming enables clients to always find the closest distribution points to download content. Clients that are managed on the Internet communicate with site systems from their assigned site when these site systems are configured to use an Internet FQDN and the site system roles allow client connections from the Internet. Clients non-deterministically select one of the Internet-based site systems, regardless of bandwidth or physical location.
- Clients and Site Systems supporting IBCM should have Internet Connectivity.
- Site systems that will support Internet-based client management must be in an Active Directory domain, but can be in a different Active Directory forest from the forest that contains the site server.
- You must have a supporting public key infrastructure (PKI) that can deploy and manage the certificates that the clients require and that are managed on the Internet and the Internet-based site system servers.
For more information see Planning for Communications in Configuration Manager at http://technet.microsoft.com/en-us/library/gg712701.aspx#BKMK_PrerequisitsForInternetClientMgmt.
The links below can help you in planning & configuring IBCM in your environment:
- Planning for IBCM: http://technet.microsoft.com/en-us/library/gg712701.aspx#Support_Internet_Clients
- Planning for Communications in Configuration Manager: http://technet.microsoft.com/en-us/library/gg712701.aspx
- Planning for Certificates: http://technet.microsoft.com/en-us/library/gg712284.aspx#BKMK_PlanningForCertificates
- PKI Certificate Requirements for Configuration Manager: http://technet.microsoft.com/en-us/library/gg699362.aspx
- Step by step deployment of certificates: http://technet.microsoft.com/en-us/library/gg682023.aspx
Internet-only management : Such clients will always contact the FQDN of the Internet Management Point (MP). Below is an example command line used to install a client in this manner.
Ccmsetup.exe /usepkicert ccmhostname=”FQDN of Internet MP” smssitecode=”Site code” CCMALWAYSINF=1
Internet or Intranet management : Clients configured for this scenario will be able contact the FQDN of both Internet and Intranet MPs depending on the network it is on (e.g. LAN or Internet). Note that workgroup clients do not support this scenario. Here’s a command line for this type of install:
Ccmsetup.exe /usepkicert smsmp=”FQDN of Intranet MP” ccmhostname=”FQDN of Internet MP” smssitecode=”Site code”
See the article below to understand the purpose of switches used in both cases. You may add more of them depending upon your requirements.
How to Install Clients on Windows-Based Computers in Configuration Manager : http://technet.microsoft.com/en-us/library/gg712298.aspx
- There should be a site system that will be used as an Internet Management Point. It should be published via public DNS. If there is only one site system that is a site server itself then you can still use it as an Internet MP.
- Under site properties, verify “Client computer communication -> client computer settings” and make sure that “Use PKI client certificate when available” is checked.
- For the site system that will act as an Internet MP, please make sure that correct URL has been specified under the Site System property “Specify an FQDN for this site system for use on the Internet”.
- In the Internet MP properties, make sure that HTTPS is enabled (checked), and depending upon your requirement, that either “Allow Internet-only connections” or “Allow Internet and Intranet connections” is checked.
- After the above is done, make sure that the web server certificate has the name of the Internet MP in the Subject Alternative Name. After you have done this, then bind this certificate in IIS and check MPcontrol.log to confirm the health of the MP.
Symptoms: After installing a ConfigMgr 2012 agent on an IBCM client, the machine is unable to register with the Internet facing Management Point. The following errors can be seen:
Client machine log:
ClientIDmanagerstartup.log - Server rejected request 3
Server Side log:
MP_Registration.log - Registration hint is expired.
CCMValidateAuthHeaders failed (0x87d0029b) to validate headers for client 'GUID:xxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
MP Reg: Certificate is not valid, HR = 0x80092012, In-band Cert SubjectName = xxxxxxx.COM (NAME OF THE CLIENT MACHINE)
Cause: Error 0x80092012 reads:
“The revocation function was unable to check revocation for the certificate.
CRL was neither published nor accessible from the client machine.
PORT 10123 was blocked on the hardware firewall in the internal network from the outside network.”
Resolution:
First publish the CRL and verify that it can be accessed from the client. You can verify whether the CRL is accessible by running the following command:
Certutil –verify –urlfetch <cert name>.cer
If this shows that the CRL is not accessible, check the ports. You may notice that port 10123 is blocked.
Port 10123 is used by the Management Point to notify client computers about an action that it must take when an administrative user selects a client action in the Configuration Manager console, such as download computer policy or initiate a malware scan. If this is blocked, add the following as an exception to the Windows Firewall:
Outbound: TCP Port 10123
If this communication does not succeed, Configuration Manager automatically falls back to using the existing client-to-Management Point communication port of HTTP or HTTPS:
Outbound: TCP Port 80 (for HTTP communication)
Outbound: TCP Port 443 (for HTTPS communication)
======
Symptoms: After installing a ConfigMgr 2012 agent on an IBCM client, the machine is unable to register with the Internet facing Management Point. The following errors can be seen:
Locationservices.log
LSRefreshTrustedKeyInfo failed with error '0x87d00306'
Failed to refresh trusted key info with error '0x87d00306'
Failed to validate the certificate
'308205E8308204D0A00302010202….0D99AAFC70BB0999B548CD07' from management point 'abc.test.com'
Raising event:
instance of CCM_LocationServices_ManagementPointCertificate_CrossVerificationFailure
{
DateTime = "20130819094515.860000+000";
ManagementPoint = "abc.test.com";
ProcessID = 1608;
ThreadID = 2192;
};
Refreshed Certificate Information over HTTP
Failed to verify message. Could not retrieve certificate from MPCERT.
MPCERT requests are throttled for 00:04:59
Failed to send site information Location Request Message to abc.test.com
LSIsSiteCompatible : Client is Always on Internet. Unable to check compatibiliy of Site <SITE CODE>
LSRefreshSiteCode failed with error (0x8000ffff)
Cause: This can occur if the trusted root key on the client is incorrect or non-existent. Follow the steps below to verify if the trusted roots key exists:
1. On the Start menu, click Run, and then type Wbemtest.
2. In the Windows Management Instrumentation Tester dialog box, click Connect.
3. In the Connect dialog box, in the Namespace box, type root\ccm\locationservices and then click Connect.
4. In the Windows Management Instrumentation Tester dialog box, in the IWbemServices section click Enum Classes.
5. In the Superclass Info dialog box, select Recursive and then click OK.
6. In the Query Result window, scroll to the end of the list and then double-click TrustedRootKey ().
7. In the Object editor for TrustedRootKey dialog box, click Instances.
8. In the new Query Result window that displays the instances of TrustedRootKey, double-click TrustedRootKey=@
9. In the Object editor for TrustedRootKey=@ dialog box, in the Properties section, scroll down to TrustedRootKey CIM_STRING. The string in the right column is the trusted root key. Verify that it matches the SMSPublicRootKey value in the file <Configuration Manager directory>\bin\mobileclient.tcf.
If the key is not there, complete the resolution steps below.
Resolution:
Uninstall the client using ccmclean utility, then reinstall it by specifying the trusted root key using following command line:
ccmsetup.exe /usePKICert /NOCRLCheck CCMHOSTNAME=abc.test.com CCMALWAYSINF=1 SMSMP=https://abc.test.com SMSSITECODE=001
======
When multiple CA’s are being used to issue required certificates to Internet MP & Client authentication certificate
CA1: Issuer of web server certificate for Internet MP.
CA2: Issuer of client certificate on IBCM clients.
After installing the client with the above mentioned command line, you may see this error on a client machine:
ClientIDManagerStartup.log:
Failed in GetCertificate(…): 0x87d00281
Error code 87d00281 means “No certificate matching criteria specified”
In order to resolve this, navigate to Client Computer Communication under Site Properties and go to Trusted Root Certification Authorities and click on Set. Afterdoing that, specify the self-signed cert of CA2 without its private key and click on OK.
Then, restart ccmexec on the client machine and now it should be able to register.
Prabhat Joshi| Technical Lead | Microsoft
Get the latest System Center news on Facebook and Twitter:
Image may be NSFW.
Clik here to view.Image may be NSFW.
Clik here to view.
System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm
Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/
App-V Team blog: http://blogs.technet.com/appv/
MED-V Team blog: http://blogs.technet.com/medv/
Server App-V Team blog: http://blogs.technet.com/b/serverappv
The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/
Image may be NSFW.
Clik here to view.
An update is available for Microsoft System Center Configuration Manager 2007 Service Pack 2. The update adds Windows 8.1 and Windows Server 2012 R2 to the list of supported platforms for the following features:
- Software distribution
- Software update management
- Desired configuration management
For all the details including a download link, please see the following:
KB2861663 - An update is available that adds support for Windows 8.1 and Windows Server 2012 R2 to System Center Configuration Manager 2007 Service Pack 2 (http://support.microsoft.com/kb/2861663)
J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division
Get the latest System Center news onFacebookandTwitter:
Image may be NSFW.
Clik here to view.Image may be NSFW.
Clik here to view.
System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm
Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/
The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/
Image may be NSFW.
Clik here to view.
An update is available to address issues that were discovered after the release of Cumulative Update 3 (CU3) for Microsoft System Center 2012 Configuration Manager Service Pack 1 (SP1).
For more information on what is fixed as well as a download link, please see the following:
KB2894539 - A post-CU3 update is available for System Center 2012 Configuration Manager SP1 (http://support.microsoft.com/kb/2894539)
J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division
Get the latest System Center news onFacebookandTwitter:
Image may be NSFW.
Clik here to view.Image may be NSFW.
Clik here to view.
System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm
Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/
The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/
scvmm 2012
Image may be NSFW.Image may be NSFW.
Clik here to view.![KB5333[3][3]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/6874.KB533333_5F00_32811700.jpg "KB5333[3][3]")
Consider the following scenario:
- In Microsoft System Center 2012 Configuration Manager Service Pack 1 (SP1), you select a Windows Server 2012 operating system image and then start the Schedule Updates Wizard.
- You select X64 in the System Architecture combo box on the Choose Updates page of the wizard.
In this scenario, no available software updates are listed for the Windows Server 2012 operating system image.For more information please see the following:
KB2893495 - The Schedule Updates Wizard does not list all available software updates for an x64 version of a Windows Server image in System Center 2012 Configuration Manager SP1 (http://support.microsoft.com/kb/2893495)
J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division
Get the latest System Center news onFacebookandTwitter:
Image may be NSFW.
Clik here to view.Image may be NSFW.
Clik here to view.
System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm
Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/
The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/
scvmm 2012
Image may be NSFW.Image may be NSFW.
Clik here to view.![KB5333[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/3162.KB53334_5F00_2E389364.jpg "KB5333[4]")
This article introduces the support policy for Microsoft System Center 2012 Configuration Manager and System Center 2012 Endpoint Protection to manage server software in the Windows Azure Virtual Machine environment (infrastructure-as-a-service).
System Center 2012 Configuration Manager Service Pack 1 (SP1) or later versions and System Center 2012 Endpoint Protection SP1 or later versions support two specific scenarios to manage server software in the Windows Azure Virtual Machine environment.
For information on these scenarios please see the following:
KB2889321 - System Center 2012 Configuration Manager and System Center 2012 Endpoint Protection support for Windows Azure Virtual Machines (http://support.microsoft.com/kb/2889321)
J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division
Get the latest System Center news onFacebookandTwitter:
Image may be NSFW.
Clik here to view.Image may be NSFW.
Clik here to view.
System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm
Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/
The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/
Configmgr 2012 scep 2012
Image may be NSFW.~ Ashish Kumar | Technical Lead
Image may be NSFW.
Clik here to view.
Hello all, my name is Ashish and I am Technical Lead with the Configuration Manager support team. System Center 2012 R2 Configuration Manager (ConfigMgr 2012 R2) is scheduled to be released soon and there’s a cool new feature you’ll want to be aware of. This new feature allows us to deploy an operating system and create a Virtual Hard Disk (VHD) at the same time, meaning that we can now deploy an operating system directly to a VHD that can be given to the VMM admins for further use.
Say for example that you have a Virtual Machine Manager administrator who has a project where he needs multiple VMs for production use. The standard procedure would be to manually create a VM, install the OS, install all of the required applications on that VM, and then use that VM on all of the other production machines. Now this all can be achieved by ConfigMgr 2012 R2 using a new Task Sequence (TS) that will do all of this for you in a single process. Here are the steps ConfigMgr 2012 R2 uses to create this new Virtual Hard Drive:
1) Configuration Manager creates a Task Sequence media.
2) Configuration Manager creates a Virtual Hard Disk.
3) Configuration Manager creates a temporary virtual machine (VM) on the Hyper-V Server.
4) Configuration Manager allocates the resources to the created temporary VM.
5) Configuration Manager mounts the Task Sequence media to the VM.
6) Configuration Manager attaches the VHD to the VM.
7) Configuration Manager executes the Task Sequence.
8) Once the Task Sequence completes, the temporary VM is stopped and the VHD is copied to a share location.
NOTE: While the steps above will create our VHD, there is an additional prerequisite that is required. In addition to the standard prerequisites for VMM (see http://technet.microsoft.com/en-us/library/gg610592.aspx), we also need a server with Hyper-V running on it, and this server needs to have the ConfigMgr 2012 R2 console installed.
Here is an example of how we can deploy an operating system to a Virtual Hard Drive using ConfigMgr 2012 R2:
First we select our new type of Task Sequence that allows us to install an existing Windows image package to a Virtual Hard Drive:
Image may be NSFW.
Clik here to view.![clip_image002[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/2630.clip_5F00_image0024_5F00_thumb_5F00_1FE8BF55.jpg "clip_image002[4]")
The rest of the Task Sequence is essentially the same as a regular Task Sequence, however there is an extra step that is added as part of this new Task Sequence: The “Shutdown computer” step.
Image may be NSFW.
Clik here to view.![clip_image004[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/8030.clip_5F00_image0044_5F00_thumb_5F00_29617DCB.jpg "clip_image004[4]")
This is an important part of the TS as this step allows the VM to shut down and then pass control to Configuration Manager to copy the VHD package. Once we have created the Task Sequence to deploy an OS to a Virtual Hard Disk, we will create the Virtual Hard Disk itself. To create this, we now have an additional node in Operating Systems for “Virtual Hard Disks”.
Image may be NSFW.
Clik here to view.![clip_image006[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/7318.clip_5F00_image0064_5F00_thumb_5F00_27B0B1F7.jpg "clip_image006[4]")
Note that if the Configuration Manager server is not a Hyper-V host we will not get the option to create a Virtual Hard Disk as Configuration Manager needs to interact with the hypervisor to create the virtual machine, perform all the steps in the TS, and then delete the VM. In this process, the Configuration Manager console interacts with Hyper-V which is why we require a dedicated Hyper-V server with the ConfigMgr 2012 R2 console.
Below is a screen shot from my Hyper-V server that has the ConfigMgr 2012 R2 console installed.
Image may be NSFW.
Clik here to view.![clip_image007[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/8838.clip_5F00_image0074_5F00_thumb_5F00_0D0415DE.jpg "clip_image007[4]")
In the Create Virtual Hard Drive wizard, we specify the general description of the Virtual Hard Disk and a share location to store the VHD file created during the process.
Image may be NSFW.
Clik here to view.![clip_image009[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/5483.clip_5F00_image0094_5F00_thumb_5F00_446A270C.jpg "clip_image009[4]")
The next step allows you to select the Task Sequence for deployment. Make sure to select the Task Sequence we created for the Virtual Hard Disk. You will see the option to select other kinds of Task Sequences but those will fail.
Once we select our Task Sequence we have a preview of all the packages in the TS.
Image may be NSFW.
Clik here to view.![clip_image011[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/3343.clip_5F00_image0114_5F00_thumb_5F00_49D897B0.jpg "clip_image011[4]")
After this step we get to see the introduction of another new feature in ConfigMgr 2012 R2, a preview of the packages which are required in a TS and their distribution status on the Distribution Point (DP).
Image may be NSFW.
Clik here to view.![clip_image013[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/8512.clip_5F00_image0134_5F00_thumb_5F00_7D345B0C.jpg "clip_image013[4]")
We can clearly see in the above screen shot that there are 3 packages required in my TS and out of them 2 are not on the DP. This is a hard block now and we will not be able to proceed until we distribute all of the required packages to the DP.
After distributing the packages, we also get the option to choose which DP will be used to download these packages. This has an added bonus of allowing us to isolate DP related issues and package related issues we may run into after running the Task Sequence.
Image may be NSFW.
Clik here to view.![clip_image015[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/6404.clip_5F00_image0154_5F00_thumb_5F00_26C82640.jpg "clip_image015[4]")
Here is a preview showing the available Distribution Points and the package distribution status.
Image may be NSFW.
Clik here to view.![clip_image017[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/6835.clip_5F00_image0174_5F00_thumb_5F00_45326729.jpg "clip_image017[4]")
We also have a preview that shows the DP selected to be used by the Task Sequence to download the required packages.
Once we initiate this wizard, the Operating System Deployment to the Virtual Hard Drive begins.
Image may be NSFW.
Clik here to view.![clip_image019[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/8037.clip_5F00_image0194_5F00_thumb_5F00_1CB38515.jpg "clip_image019[4]")
This wizard can be monitored by a log file named DeplottoVHD.log. This log is found in the AdminUILOG folder in the Admin console installation Directory.
Image may be NSFW.
Clik here to view.![clip_image021[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/1121.clip_5F00_image0214_5F00_thumb_5F00_3B1DC5FE.jpg "clip_image021[4]")
As seen here, the wizard’s first step is to create a Task Sequence media. This creation of the media can be seen in DeploytoVHD.log which is monitored by the CreateTSMedia component and logged in the AdminUILog folder.
Image may be NSFW.
Clik here to view.![clip_image023[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/2465.clip_5F00_image0234_5F00_thumb_5F00_408C36A2.jpg "clip_image023[4]")
This is the same process that is logged when we create a normal Task Sequence media except for the fact that in this case TS media is created by Configuration Manager and mounted to the temporary VM.
Once the TS Media is created, the Deploy to VHD component comes into the picture. This creates a temporary VM, allocates the necessary resources to the machine, mounts the TS media and starts the execution.
Image may be NSFW.
Clik here to view.![clip_image025[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/5040.clip_5F00_image0254_5F00_thumb_5F00_0CE3CA44.jpg "clip_image025[4]")
The CreateTSMedia.log snippet above shows that the process of Task Sequence media creation has completed.
Image may be NSFW.
Clik here to view.![clip_image027[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/8713.clip_5F00_image0274_5F00_thumb_5F00_7D60B874.jpg "clip_image027[4]")
Above in our DeploytoVHYD.log we can see Configuration Manager creating a virtual machine, allocating the resources, mounting the TS media, attaching the VHD and starting the VM.
This log will pause here for some time and wait for the Task Sequence to complete the deployment.
Image may be NSFW.
Clik here to view.![clip_image029[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/5047.clip_5F00_image0294_5F00_thumb_5F00_1BCAF95E.jpg "clip_image029[4]")
Image may be NSFW.
Clik here to view.![clip_image031[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/2742.clip_5F00_image0314_5F00_thumb_5F00_68228CFF.jpg "clip_image031[4]")
We can see above how a temporary virtual machine is created on the Hyper-V server.
Once the Task Sequence completes on the virtual machine, the machine will be shut down and the VHD created as part of the TS will be copied to the shared location specified in the Create Virtual Hard Disk wizard.
Image may be NSFW.
Clik here to view.![clip_image033[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/5415.clip_5F00_image0334_5F00_thumb_5F00_5FBEB7A8.jpg "clip_image033[4]")
The snippet above of the DeploytoVHD.log shows that after waiting for the VM to shut down, the VHD was copied to the shared location.
Once the Wizard is complete we can see our VHD in the create VHD node with the description we entered previously.
Image may be NSFW.
Clik here to view.![clip_image035[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/1256.clip_5F00_image0354_5F00_thumb_5F00_1E44054F.jpg "clip_image035[4]")
We might now be thinking of what can we do with this VHD and the answer lies on the same Create VHD node. As we all know, Virtual Machine Manager is part of the System Center suite which includes Configuration Manager, and now with ConfigMgr 2012 R2 we can upload this VHD created by Configuration Manager to your Virtual Machine Manager server directly.
Image may be NSFW.
Clik here to view.![clip_image037[4]](http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-69-06-metablogapi/6283.clip_5F00_image0374_5F00_thumb_5F00_15E02FF8.jpg "clip_image037[4]")
Now your VHD is ready to be used by your VMM 2012 administrators.
NOTE: For additional information, see How to Manage Virtual Hard Disks in Configuration Managerat http://technet.microsoft.com/en-us/library/dn448591.aspx.
Ashish Kumar | Technical Lead
Get the latest System Center news onFacebookandTwitter:
Image may be NSFW.
Clik here to view.
Image may be NSFW.
Clik here to view.
System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm
Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/
The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/
Image may be NSFW.
Clik here to view.
When you use the Add-CMStateMigrationPoint Windows PowerShell cmdlet that was introduced in Cumulative Update 1 for System Center 2012 Configuration Manager Service Pack 1 to create a new State Migration Point (SMP), an incorrect ServerRemoteName value is set. Additionally, you receive the following error message in the Smpisapi.log file:
::SecureAccess(pszStorePath, m_sAccessAccount, dwAccess, bGrantAccess), HRESULT=80070043 (e:\nts_sccm_release\sms\server\smp\isapi\smprequesthandler.cpp,941) smpisapi
AddACE to store with access account failed for directory \\SMPSTOREM_28C49E47$\FBC02D2321401636EFBD99756C5AAF338C3D018C06B9724EB56B409163928473. smpisapi
hr, HRESULT=80070043 (e:\nts_sccm_release\sms\server\smp\isapi\smprequesthandler.cpp,2311) smpisapi
Revoke access failed for directory \\SMPSTOREM_28C49E47$\FBC02D2321401636EFBD99756C5AAF338C3D018C06B9724EB56B409163928473. smpisapi
StatusRequest::UpdateStatus failed with errorcode (0x80070043) smpisapi
For information on how to work around this issue please see the following:
KB2891764 - The Add-CMStateMigrationPoint cmdlet in System Center 2012 Configuration Manager sets an incorrect ServerRemoteName value (http://support.microsoft.com/kb/2891764)
J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division
Get the latest System Center news onFacebookandTwitter:
Image may be NSFW.
Clik here to view.Image may be NSFW.
Clik here to view.
System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm
Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/
The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/
scvmm 2012
Image may be NSFW.If you are currently using Windows XP today, make sure that you are running Windows XP with Service Pack 3 (SP3) so that you can receive all the latest updates that are available.
Note: There's no SP3 for the 64-bit version of Windows XP. If you're running the 64-bit version of Windows XP with SP2, you have the latest service pack. To find out what version you're running, seeIs my PC running the 32-bit or 64-bit version of Windows?
Also note that support for Windows XP ends April 8, 2014. If you are running Windows XP after support ends, to ensure that you will continue to receive all important security updates for Windows you will need to upgrade to a later version such as Windows 8.
For more information, see Support is ending for some versions of Windows.
To help you prepare for the pending EOL of Windows XP, we put together a few links that should help as you move to a newer version.
- A Year From Now Support for Windows XP Ends, Now What? (http://blogs.windows.com/windows/b/business/archive/2013/04/08/a-year-from-now-support-for-windows-xp-ends-now-what.aspx)
- KB828287 - Unsupported Sysprep Scenarios (http://support.microsoft.com/kb/828287)
- Announcement: The ADK for Windows 8.1 has been updated: (http://blogs.technet.com/b/configmgrteam/archive/2013/10/23/announcement-the-adk-for-windows-8-1-has-been-updated.aspx)
- KB2018593 - When using USMT 4 in a Configuration Manager 2007 SP2 OSD Task Sequence, files are captured successfully but settings are not (http://support.microsoft.com/kb/2018593)
- Deploying Windows 8 with System Center 2012 Configuration Manager Service Pack 1: http://blogs.technet.com/b/configmgrteam/archive/2013/01/29/deploying-windows-8-with-system-center-2012-configuration-manager-service-pack-1.aspx
- How to migrate user data from Windows XP to Windows 8.1 with System Center 2012 R2 Configuration Manager : http://blogs.technet.com/b/configmgrteam/archive/2013/09/12/how-to-migrate-user-data-from-win-xp-to-win-8-1-with-system-center-2012-r2-configmgr.aspx
Additional online information and resources are available by visiting the Windows XP SP3 and Office 2003 end of support site.
J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division
Get the latest System Center news onFacebookandTwitter:
Image may be NSFW.
Clik here to view.Image may be NSFW.
Clik here to view.
System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm
Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/
The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/
Image may be NSFW.
Clik here to view.
Want to know all the default settings for the Maintenance tasks in ConfigMgr 2012 and ConfigMgr 2012 R2? This new article is for you:
KB2897050 - Maintenance tasks default settings in System Center 2012 and System Center 2012 R2 Configuration Manager (http://support.microsoft.com/kb/2897050)
J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division
Get the latest System Center news onFacebookandTwitter:
Image may be NSFW.
Clik here to view.Image may be NSFW.
Clik here to view.
System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm
Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/
The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/
scvmm 2012
Image may be NSFW.Image may be NSFW.
Clik here to view.
Consider the following scenario:
- You create a package on a Microsoft System Center Configuration Manager 2007 Service Pack 2 (SP2) site server.
- You click to select the Enable binary differential replication check box on the Data Source tab of the Properties dialog box for the package.
- Some files in the package are larger than 4 gigabytes (GB).
In this scenario, the delta file merge process fails for the larger files.
For additional details and a link to a ConfigMgr 2007 hotfix that resolves this issue please see the following:
KB2641584 - The delta file merge process fails when the "Enable binary differential replication" option is enabled in a System Center Configuration Manager 2007 SP2 environment (http://support.microsoft.com/kb/2641584)
J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division
Get the latest System Center news onFacebookandTwitter:
Image may be NSFW.
Clik here to view.Image may be NSFW.
Clik here to view.
System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm
Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/
The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/
scvmm 2012
Image may be NSFW.