System Center SCCM ve SCOM Türkiye

Configuration Manager 2012 Client Health Evaluation / Configuration Manager 2012 İstemci Sağlık Değerlendirmesi

Ismail-TS — Wed, 29 Aug 2012 13:59:49 GMT

How to / Nasıl yaparım:

SCCM 2012 iştemcisi ile cebrenizdeki bakım işleri azalacaktır. Microsoft iştemcileri denetlemek için yüklenme esnasında bunada yer vermiştir:

PC üstüne otomatik olarak bir TASK oluşturuluyor:

TASK Sheduler/ TASK Sheduler Library/Microsoft/Configuration Manager/Configuration Manager Health Evaluation. Bu TASK her gece 00:58 civarına ayarlanmıştır ve otomatik olarak ccmeval.exe çalıştırmaktadır.

TASK ayarları bu şekildedir:

“Run task as soon as possible after a scheduled start is missed” ayarı bulunduğu için PC online olacağı zaman tekrar çalışsacaktır.

Ccmeval neyi denetliyor? Aşağıda size ccmeval.log içinden hangi gerekimseler denetlendiğini görebilirsiniz:

Evaluating health check rule : Verify WMI service exists.
Evaluating health check rule : Verify/Remediate WMI service startup type.
Evaluating health check rule : Verify/Remediate WMI service status.
Evaluating health check rule : WMI Repository Read/Write Test.
Evaluating health check rule : WMI Repository Integrity Test.
Evaluating health check rule : Verify BITS exists.
Evaluating health check rule : Verify/Remediate BITS startup type.
Evaluating health check rule : Verify/Remediate client prerequisites.
Evaluating health check rule : Verify/Remediate client installation.
Evaluating health check rule : Verify SMS Agent Host service exists.
Evaluating health check rule : Verify/Remediate SMS Agent Host service startup type.
Evaluating health check rule : Verify/Remediate SMS Agent Host service status.
Evaluating health check rule : WMI Event Sink Test.
Evaluating health check rule : Verify/Remediate Microsoft Policy Platform service startup type.
Evaluating health check rule : Verify/Remediate Antimalware service startup type.
Evaluating health check rule : Verify/Remediate Antimalware service status.
Evaluating health check rule : Verify/Remediate Network Inspection service startup type.
Evaluating health check rule : Verify/Remediate Windows Update service startup type.
Evaluating health check rule : Verify/Remediate Windows Update service startup type on Windows 8.
Evaluating health check rule : Verify/Remediate Windows Update service status.
Evaluating health check rule : Verify/Remediate Configuration Manager Remote Control service startup type.
Evaluating health check rule : Verify/Remediate Configuration Manager Remote Control service status.
Evaluating health check rule : Verify/Remediate SQL CE database is healthy.

Güzel olan yukarıdaki gerekimselerden birisi hatalı olacak olursa otomatik olarak bunun tamiri yapılmaktadır.

Istersniz bir deneyelim: SMS agent Host servisini kapatalım ve disabled durumuna getirin. Task Scheduler açalım ve “Configuration Manager Health Evaluation” tetikliyelim, ccmeval.log içinden takip edebilirsiniz. Ccmeval sonladığında servisin tekrar çalıştığını ve otomatik olarak değiştirlmiş olduğunu göreceksinz.

Source: http://blogs.msdn.com/b/scstr/

Source: http://www.mycloud-tr.com/

İsmail Şen

SCCM 2012 Client Installation issue

Ismail-TS — Wed, 22 Aug 2012 10:49:42 GMT

How to / Nasıl yaparım:

SCCM 2012 Client cannot be installed. Error on the ccmsetup.log:

MSI: Action 17:10:28: SmsInstallPrepDrvrInit. Custom action to schedule the deferred execution of SmsInstallPrepDriver. ccmsetup 03.07.2012 17:10:28 608 (0x0260)

MSI: Action 17:10:28: SmsInstallPrepDrvr. Installing Software Metering PREP Driver ccmsetup 03.07.2012 17:10:28 608 (0x0260)

MSI: Action 17:10:28: StartServices. Starting services ccmsetup 03.07.2012 17:10:28 608 (0x0260)

MSI: Action 17:10:28: CcmStartService. Starts the ccmexec service. ccmsetup 03.07.2012 17:10:28 608 (0x0260)

MSI: Action 17:10:28: SmsClientInstallSucceeded. Sends a wmi event to indicate client installation succeeded. ccmsetup 03.07.2012 17:10:28 608 (0x0260)

MSI: Action 17:10:28: InstallFinalize. ccmsetup 03.07.2012 17:10:28 608 (0x0260)

MSI: Action 17:10:28: CcmStopService. Stops the ccmexec service. ccmsetup 03.07.2012 17:10:28 608 (0x0260)

MSI: Action 17:10:28: StopServices. Stopping services ccmsetup 03.07.2012 17:10:28 608 (0x0260)

MSI: Action 17:10:28: SmsUninstallPrepDrvr. Uninstalling Software Metering PREP Driver ccmsetup 03.07.2012 17:10:28 608 (0x0260)

MSI: Warning 25702. Failed to uninstall PrepDrvr.Sys for Software Metering Agent. ccmsetup 03.07.2012 17:10:28 608 (0x0260)

MSI: Action 17:10:28: SmsStopUIComponents. This custom action forces all open client UI components to stop and exit. ccmsetup 03.07.2012 17:10:28 608 (0x0260)

MSI: Action 17:10:28: SmsStopUserComponents. This custom action forces all open client UI and SCNotification components to stop and exit. ccmsetup 03.07.2012 17:10:28 608 (0x0260)

MSI: Module C:\Windows\CCM\StatusAgentProxy.dll failed to register. HRESULT -2147010895. Contact your support personnel. ccmsetup 03.07.2012 17:10:43 608 (0x0260)

File C:\Windows\ccmsetup\{F9BE5FE5-D87B-4958-9BBB-B613A2F4075E}\client.msi installation failed. Error text: ExitCode: 1603

Action: SelfRegModules.

ErrorMessages:

Module C:\Windows\CCM\StatusAgentProxy.dll failed to register. HRESULT -2147010895. Contact your support personnel.

ccmsetup 03.07.2012 17:10:45 608 (0x0260)

MSI.log:

CustomAction +StatusAgentProxy_dll.A6940213_CD40_4753_8BA2_E803376DECC3 returned actual error code -2147010895 (note this may not be 100% accurate if translation happened inside sandbox)

MSI (s) (E4:28) [19:11:08:674]: Product: Configuration Manager Client -- Error 1904. Module C:\Windows\CCM\StatusAgentProxy.dll failed to register. HRESULT -2147010895. Contact your support personnel.

Error 1904. Module C:\Windows\CCM\StatusAgentProxy.dll failed to register. HRESULT -2147010895. Contact your support personnel.

MSI (s) (E4:28) [19:11:10:390]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)

……..

MSI (s) (E4:88) [19:10:54:493]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIAE7C.tmp, Entrypoint: SmsUninstallPrepDrvr

MSI (s) (E4!88) [19:10:54:493]: Closing MSIHANDLE (10475) of type 790531 for thread 8584

[19:10:54] Failed to open service, error 80070424

Warning 25702. Failed to uninstall PrepDrvr.Sys for Software Metering Agent.

MSI (s) (E4:28) [19:10:54:493]: Executing op: CustomActionSchedule(Action=SmsStopUIComponents,ActionType=3073,Source=BinaryData,Target=SmsStopUIComponents,)

MSI (s) (E4:28) [19:11:05:491]: Source for file 'smserrors_dll.43F063D4_4A7B_4402_BA1E_93454819EF9E' is compressed

Çözüm:

PC/Sunucu üstünden yüklü olan (x86 ve x64) C++ kaldırın ve reboot edin. Reboot tan sonra bu version indirip PC/sunucuya yükleyelim: http://www.microsoft.com/en-us/download/details.aspx?id=26368 (Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package MFC Security Update)

Şimdi tekrar SCCM agenti yüklemeye çalışın.

Source: http://blogs.msdn.com/b/scstr/

Source: http://www.mycloud-tr.com/

İsmail Şen

SCCM 2007/2012 FEP Agenti kullanıcılar görmesin

Ismail-TS — Wed, 22 Aug 2012 08:45:34 GMT

How to / Nasıl yaparım:

Sorun:

FEP Clientı kullanıcıların TASK ından nasıl kaldırabiliriz. Bu yönten normal PC yada Terminal Server için geçerli olsun.

Çözüm:

Bu registry key kaldırın:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "MSC"="\"c:\\Program Files\\Microsoft Security Client\\msseces.exe\" -hide -runkey"

Bu ayarı GPO ile tüm cevrenize uygulayabilirsiniz.

Source: http://blogs.msdn.com/b/scstr/

Source: http://www.mycloud-tr.com/

İsmail Şen

SCCM 2012 Ports

Ismail-TS — Mon, 23 Jul 2012 04:11:49 GMT

From	To	Protocol	TCP	TCP	UDP Port
Asset Intelligence Syncronization Point	System Center Online	HTTPS		443
Application Catalog Website Point	Application Catalog Web Service Point	HTTPS		443
Endpoint Protection Point	Internet	HTTP	80
Client	Application Catalog Website Point	HTTP or HTTPS	80	443
Client	Distribution Point	HTTP or HTTPS	80	443
Client	Distribution Point Configured for Multicast	SMB and Multicast	445		63000-64000
Client	Global Catalog Domain Controller	LDAP or LDAP	3268	3269
Client	Management Point	HTTP or HTTPS	80	443
Client	Software Update Point	HTTP or HTTPS	80 or 8530	443 or 8531
Client	State Migration Point	SMB and HTTP or HTTPS	445 and 80	443
Client	Server Shares	SMB	445
Client	System Health Validator		NAP	NAP
Configuration Manager Console	Client	RC amd RDP	2701 and 3389
Configuration Manager Console	Internet	HTTP	80
Configuration Manager Console	Reporting Service Point	HTTP or HTTPS	80	443
Configuration Manager Console	Site Server	RPC to WMI	135
Configuration Manager Console	SMS Provider	RPC Endpoint Mapper	135 and Dynamic		135
Management Point	Domain Controller	LDAP	389
		LDAP SSL		636	636
		Global Catalog LDAP	3268
		Global Catalog LDAP SSL		3269
		RPC Endpoint Mapper	135		135
		RPC	Dynamic
Management Point	Site Server	RPC Endpoint Mapper	135
		SMB	445
		RPC	Dynamic
Management Point	SQL Server	SQL over TCP	1433
Mobile Device Client	Enrollment Proxy Point	HTTPS		443
Out of Band Service Point	Enrollment Point	HTTPS		443
Out of Band Service Point	AMT Management Controller	Provisioning/Discovery		16993
Out of Band Management Console	AMT Management Controller	Management		16993
		Serial over LAN and IDE		16995
Reporting Service Point	SQL Server	SQL over TCP	1433
Site Server	Application Catalog Web Service Point	SMB	445
		RPC Enpoint Mapper	135		135
		RPC	Dynamic
Site Server	Application Catalog Website Point	SMB	445
		RPC Enpoint Mapper	135		135
		RPC	Dynamic
Site Server	Asset Intelligence Syncronization Point	SMB	445
		RPC Enpoint Mapper	135		135
		RPC	Dynamic
Site Server	Ditribution Point	SMB	445
		RPC Enpoint Mapper	135		135
		RPC	Dynamic
Site Server	Domain Controller	LDAP	389
		LDAP SSL		636	636
		Global Catalog LDAP	3268
		Global Catalog LDAP SSL		3269
		RPC Endpoint Mapper	135		135
		RPC	Dynamic
Site Server	Endpoint Protection Point	SMB	445
		RPC Enpoint Mapper	135		135
		RPC	Dynamic
Site Server	Enrollment Point	SMB	445
		RPC Enpoint Mapper	135		135
		RPC	Dynamic
Site Server	Enrollment Proxy Point	SMB	445
		RPC Enpoint Mapper	135		135
		RPC	Dynamic
Site Server	Internet	HTTP	80
Site Server	Fallback Status Point	SMB	445
		RPC Enpoint Mapper	135		135
		RPC	Dynamic
Site Server	Reporting Service Point	SMB	445
		RPC Enpoint Mapper	135		135
		RPC	Dynamic
Site Server	Site Server	SMB	445
Site Server	SQL Server	SQL over TCP	1433
Siter Server	SMS Provider	SMB	445
		RPC Enpoint Mapper	135		135
		RPC	Dynamic
Site Server	Software Update Point	SMB	445
		HTTP or HTTPS	80 or 8530	443 or 8531
Site Server	State Migration Point	SMB	445
		RPC Endpoint Mapper	135		135
Site Server	System Health Validator	SMB	445
		RPC Enpoint Mapper	135		135
		RPC	Dynamic
SMS Provider	SQL Server	SQL over TCP	1433
Software Update Point	Internet	HTTP	80
Software Update Point	Upstream WSUS Server	HTTP or HTTPS	80 or 8530	443 or 8531
SQL Server	SQL Server	SQL SSB	4022

Source: http://blogs.msdn.com/b/scstr/

Source: http://www.mycloud-tr.com/

İsmail Şen

NEW Windows Server

Ismail-TS — Fri, 20 Jul 2012 11:05:26 GMT

KB2677070 Yüklemesi sonrasında System Center Data Access Servisi Timeout hatası ile birlikte stopped duruma geçiyor

Ismail-TS — Tue, 03 Jul 2012 12:30:12 GMT

Merhabalar ,

Aşağıdaki workaround sonrası bu soruna asıl neden olan durum belirlendi ve aşağıdaki makale sorunun çözümü için uygulanmaya başlandı

http://support.microsoft.com/kb/2730040

The System Center Data Access Service fails to start after applying KB2677070

Bu makalede basitçe SDK servisinin crl check yapması engellenmekte ve bu da timeout oluşmasını engellemektedir.

This issue occurs because the update changes the URLs used to contact Windows Update to download the trusted and untrusted CTLs. If the old URLs were hardcoded as exceptions in the firewall or proxy, the server running the Data Access Service will fail to download the new CTLs because it can't reach the updated web address.

******************************************************************************************************************************************************************************

WorkAround

http://support.microsoft.com/kb/2677070 linkinde detaylarını bulabileceğiniz “An automatic updater of revoked certificates is available for Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2” update ‘i uygulanması sonrası System Center Data Access Servisi Timeout hatası ile birlikte stopped duruma geçiyor durumu ile karşılaşabilirsiniz. Servisi çalıştırmak istediğinizde ise aşağıdaki gibi bir hata alabilirsiniz :

Bu durum genellikle Virtual Systemlerde ve RAM miktarı önerilen miktardan az kullanımlarda olmaktadır ve uygulanılabilecek workaround’lar aşağıdaki gibidir :

Çözüm 1 :

http://support.microsoft.com/kb/2730040 makalesinde belirtildiği üzere sorun bu sistemlerin aşağıdaki linklere ulaşamaması nedeni ile oluşmaktadır.

Bu durumu aşmak için ya aşağıdaki linklere proxy üzerinden ulaşılması sağlanmalı

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

ya da CRL check ‘i System Center Data Access Servisi için devre dışı bırakmak gerekmektedir . CRL check ‘i System Center Data Access Servisi için devre dışı bırakmak için ise Microsoft.Mom.Sdk.ServiceHost.exe.config dosyası açılarak <generatePublisherEvidence enabled="false"/> değeri girilmelidir. Bu işlem sonrası dosya aşağıda ki şekilde olacaktır :

Microsoft.Mom.Sdk.ServiceHost.exe.config dosyasını aşağıdaki lokasyondan bulabilirsiniz :

· System Center Operations Manager 2007 R2: x:\Program Files\System Center Operations Manager 2007
· System Center 2012 - Operations Manager: x:\Program Files\System Center 2012\Operations Manager\Server

Çözüm 2 :

Bu durumu aşabilmek için ya yeterli RAM ‘i bu sistemlere atamanız gerekmekte ki bu aslında bir zorunluluktur ya da aşağıdaki makalede açıklandığı üzere ServicesPipeTimeout değerini registrye girip orda yeni bir timeout süresi belirlenmesi olabilir. Biz burda yeni değeri 120000 miliseconds olarak belirledik.

http://support.microsoft.com/kb/922918

Bu aşamadan sonra server’ın restart edilmesi sorunu çözümleyecektir.

To work around this problem, modify the registry to increase the default time-out value for the service control manager. To increase this value to 120 seconds, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.

2. Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control

3. In the right pane, locate the ServicesPipeTimeout entry. Note If the ServicesPipeTimeout entry does not exist, you must create it. To do this, follow these steps:

a. On the Edit menu, point to New, and then click DWORD Value.

b. Type ServicesPipeTimeout, and then press ENTER.

1. Right-click ServicesPipeTimeout, and then click Modify.

2. Click Decimal, type 120000, and then click OK. This value represents the time in milliseconds before a service times out.

3. Restart the computer.

Note This workaround may resolve the problem where the service does not start. However, we recommend that you research this problem to determine whether it is a symptom of another problem

Yukarıda highlight ettiğim üzere bu workaroundu uygulamak yerine asıl gerekliliği yerine getirmek daha uygun olacaktır.

Orkun AKSU

SCOM 2012– Default Port ( TCP 1433 ) kullanmayan bir SQL kullanılırken ilave Management Server kurulumu yapılırken kurulum hata veriyor ve Rollback yapıyor

Ismail-TS — Tue, 03 Jul 2012 12:29:01 GMT

SCOM 2012– Default Port ( TCP 1433 ) kullanmayan bir SQL kullanılırken ilave Management Server kurulumu yapılırken kurulum hata veriyor ve Rollback yapıyor

MSI logları içerisinde ise aşağıdaki içeriği görebilirsiniz :

[11:31:32]:    Error:    :Failed while setting DW security: Threw Exception.Type: System.Net.Sockets.SocketException, Exception Error Code: 0x80004005, Exception.Message: The requested name is valid, but no data of the requested type was found
[11:31:32]:    Error:    :StackTrace:   at System.Net.Dns.InternalGetHostByName(String hostName, Boolean includeIPv6)
   at System.Net.Dns.GetHostEntry(String hostNameOrAddress)
   at Microsoft.EnterpriseManagement.OperationsManager.SetupCommon.SetupUtils.CheckIsRemoteSqlServer(String sqlInstanceName)
   at Microsoft.EnterpriseManagement.OperationsManager.Setup.Common.SetupHelpers.GetAccountForDB(Account dasAccount, String sqlServerInstance, String& dasAccountForDB)
   at Microsoft.SystemCenter.Essentials.SetupFramework.InstallItemsDelegates.OMDataWarehouseProcessor.SetDataWarehouseSecurity()
[11:31:32]:    Error:    :FATAL ACTION: SetDataWarehouseSecurity
[11:31:32]:    Error:    :FATAL ACTION: DWInstallActionsPostProcessor
[11:31:32]:    Error:    :ProcessInstalls: Running the PostProcessDelegate returned false.
[11:31:32]:    Always:    :SetErrorType: Setting VitalFailure. currentInstallItem: Data Warehouse Configuration
[11:31:32]:    Error:    :ProcessInstalls: Running the PostProcessDelegate for OMDATAWAREHOUSE failed.... This is a fatal item. Setting rollback.
[11:31:32]:    Info:    :SetProgressScreen: FinishMinorStep.
[11:31:33]:    Always:    :!***** Installing: POSTINSTALL ***
[11:31:33]:    Info:    :ProcessInstalls: Rollback is set and we are not doing an uninstall so we will stop processing installs
[11:31:33]:    Always:    :****************************************************************
[11:31:33]:    Always:    :****Starting*RollBack*******************************************

Bu durum GUI ile kurulum yaparken oluşmaktadır. Bu durumu aşmak için 2. ve sonraki Management Server’lar kurulurken aşağıdaki gibi command line parametreleri kullanılarak kurulum uygulanılabilir. Bu şekilde kurulumda hata alınmayacak ve kurulum başarılı bir şekilde sonlanacaktır. Sonrasında ise Console kurulumu yapılmak istenir ise bu durumda GUI vasıtası ile işlem yapılabilir.

Non-default sql port kullanımıyla ikinci Management Server kuramamak ile ilgili olan problemin aşılması için bir workaround olarak aşağıdaki çalışmayı uyguladım ve test sistemimde başarılı bir şekilde kurulumu gerçekleştirdim.

1- Kurulum yapılacak Management Server üzerinde Administrative Command Prompt açınız

2- Komut satırından SCOM medianın olduğu sürücüye ulaşınız Örneğin benim test sistemimde bu e:\ idi

3- Aşağıdaki parametreleri size uygun olacak şekilde değiştirin ve komutu çalıştırın

setup.exe /silent /install /components:OMServer /ManagementGroupName:MercanMonitoring /SqlServerInstance:sql /SqlInstancePort:1967

/DatabaseName:OperationsManager /DWSqlServerInstance:sql /DWSqlInstancePort:1967 /DWDatabaseName:OperationsManagerDW

/ActionAccountUser:mercan\momact /ActionAccountPassword:P@ssw0rd /DASAccountUser:mercan\momsdk /DASAccountPassword:P@ssw0rd

/DataReaderUser:mercan\momDWr /DataReaderPassword:P@ssw0rd /DataWriterUser:mercan\momDWw /DataWriterPassword:P@ssw0rd

/EnableErrorReporting:Never /SendCEIPReports:0 /UseMicrosoftUpdate:0

Bu komutta kullanılan accountların ilk MS de kullanılanlar ile aynı olduğundan emin olunuz

Ben test sistemimde aşağıdaki accountları kullanmıştım

MercanMonitoring Benim test Management Group ismim

Sql sql server ismim (instance default olduğu için yazmam gerekmedi )

Port 1967

Action account mercan\momact

Sdk account (das) mercan\momsdk

Data reader account mercan\momDWr

Data writer account mercan\momDWw

4- Task Managerda MSIExec ‘in çalıştığını göreceksiniz

5- OpsMgrSetupWizard.log’u ara sıra control ederek hata alınıp alınmadığını gözlemleyiniz.

6- Kurulum bittikten sonra isterseniz önce Microsoft Report Viewer 2010 kurulumu yapıp http://www.microsoft.com/en-us/download/details.aspx?displaylang=en&id=6442

7- Sonrada Konsol’u GUI vasıtası ile kurabilirsiniz.

Orkun AKSU

SCOM 2012–SDK Servisi çalıştıktan kısa süre sonra 26325 , 26339 , 26380 eventleri ile birlikte duruyor.

Ismail-TS — Tue, 03 Jul 2012 12:02:56 GMT

2012 SCOM ortamında SDK Servisi çalıştırıldıktan kısa bir süre sonra duruyor ve sırasıyla aşağıdaki eventler Operations manager event loglara düşüyor.

Log Name:      Operations Manager
Source:        OpsMgr SDK Service
Date:          5/30/2012 12:36:26 PM
Event ID:      26325
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      tristscom12.tav.aero
Description:
An authorization store exception was thrown in the System Center Data Access service. Exception message: Unable to perform the operation because of authorization store errors.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="OpsMgr SDK Service" />
    <EventID Qualifiers="49152">26325</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-30T09:36:26.000000000Z" />
    <EventRecordID>1015057</EventRecordID>
    <Channel>Operations Manager</Channel>
    <Computer>tristscom12.tav.aero</Computer>
    <Security />
</System>
<EventData>
    <Data>Unable to perform the operation because of authorization store errors.</Data>
</EventData>
</Event>

Log Name:      Operations Manager
Source:        OpsMgr SDK Service
Date:          5/30/2012 12:36:26 PM
Event ID:      26339
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      tristscom12.tav.aero
Description:
An exception was thrown while initializing the service container.
Exception message: Initialize
Full exception: Feature of type 'Microsoft.EnterpriseManagement.ServiceDataLayer.IAuthorizationFeature, Microsoft.EnterpriseManagement.DataAccessService.Core, Version=7.0.5000.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' cannot be added to the container.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="OpsMgr SDK Service" />
    <EventID Qualifiers="49152">26339</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-30T09:36:26.000000000Z" />
    <EventRecordID>1015058</EventRecordID>
    <Channel>Operations Manager</Channel>
    <Computer>tristscom12.tav.aero</Computer>
    <Security />
</System>
<EventData>
    <Data>Initialize</Data>
    <Data>Feature of type 'Microsoft.EnterpriseManagement.ServiceDataLayer.IAuthorizationFeature, Microsoft.EnterpriseManagement.DataAccessService.Core,
Version=7.0.5000.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' cannot be added to the container.</Data>
    <Data>Microsoft.EnterpriseManagement.ConfigurationReaderException: Feature of type

'Microsoft.EnterpriseManagement.ServiceDataLayer.IAuthorizationFeature, Microsoft.EnterpriseManagement.DataAccessService.Core, Version=7.0.5000.0,
Culture=neutral, PublicKeyToken=31bf3856ad364e35' cannot be added to the container. ---> System.ServiceModel.FaultException`1[Microsoft.EnterpriseManagement.Common.UnknownAuthorizationStoreException]: The creator of this fault did not specify a Reason. (Fault Detail is equal to Microsoft.EnterpriseManagement.Common.UnknownAuthorizationStoreException: Unable to perf

Log Name:      Operations Manager
Source:        OpsMgr SDK Service
Date:          5/30/2012 12:36:26 PM
Event ID:      26380
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      tristscom12.tav.aero
Description:
The System Center Data Access service failed due to an unhandled exception.
The service will attempt to restart.
Exception:

Microsoft.EnterpriseManagement.ConfigurationReaderException: Feature of type 'Microsoft.EnterpriseManagement.ServiceDataLayer.IAuthorizationFeature,
Microsoft.EnterpriseManagement.DataAccessService.Core, Version=7.0.5000.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' cannot be added to the
container. ---> System.ServiceModel.FaultException`1[Microsoft.EnterpriseManagement.Common.UnknownAuthorizationStoreException]: The creator of this fault did
not specify a Reason. (Fault Detail is equal to Microsoft.EnterpriseManagement.Common.UnknownAuthorizationStoreException: Unable to perform the operation
because of authorization store errors. ---> System.Runtime.InteropServices.COMException (0x80070539): The security ID structure is invalid. (Exception from
HRESULT: 0x80070539)
   at Microsoft.Interop.Security.AzRoles.AzAuthorizationStoreClass.Initialize(Int32 lFlags, String bstrPolicyURL, Object varReserved)
   at Microsoft.EnterpriseManagement.Mom.Sdk.Authorization.AzManHelper.Initialize(String pathToStore, String appName, AzManHelperModes helperMode, String
storeDesc, String appDesc)
   --- End of inner exception stack trace ---).
   --- End of inner exception stack trace ---
   at Microsoft.EnterpriseManagement.ConfigurationReaderHelper.ReadFeatures(XPathNavigator navi, IContainer container)
   at Microsoft.EnterpriseManagement.ConfigurationReaderHelper.Process()
   at Microsoft.EnterpriseManagement.ServiceDataLayer.DispatcherService.Initialize(InProcEnterpriseManagementConnectionSettings configuration)
   at Microsoft.EnterpriseManagement.ServiceDataLayer.DispatcherService.InitializeRunner(Object state)

OperationsManager ve OperationsmanagerDW DB lerin security kısmında SQL Server mixed mode da iken SQL Authentication kullanan bir account kullanılırsa bu sorun oluşur. Çözüm olarak bu account çok gerekli bir account değilse silinir ve servis yeniden başlatılır.

Orkun AKSU

OSD advertised to wrong collection / İşletim sistemi yanlış collection a göndermiş iseniz

Ismail-TS — Thu, 31 May 2012 12:09:41 GMT

How to / Nasıl yaparım:

Yapılacak en büyük hata Advertismenti silmektir!!!

Advertismenti silmeyin, disble durumuna getirin, Boot Image ve Windows Imagını DP den kaldırın. Aşağıdaki link de neler yapmanız ve neler yapmamanız anlatıyor.

http://blogs.technet.com/b/system_center_configuration_manager_operating_system_deployment_support_blog/archive/2011/10/27/how-to-remediate-an-incorrectly-deployed-osd-task-sequence-in-system-center-configuration-manager-2007.aspx

How To Remediate An Incorrectly Deployed OSD Task Sequence In System Center Configuration Manager 2007

“In order to remediate the situation there are several actions that need to be taken and also several actions should also NOT be taken”

First thing what happens if you delete the advertisement: all messages will be deleted first. You will be not able to get any reports.

http://technet.microsoft.com/en-us/library/bb693900.aspx

English

If you advertised the OSD to a wrong collection don’t delete the advertisement!!!

The above links are explanining what to do and what not.

Most Important: Disable the advertisement and remove the boot Image and Windows Image from DP.

Source: http://blogs.msdn.com/b/scstr/

Source: http://www.mycloud-tr.com/

İsmail Şen

How to use User State Migration Tool for Operating System Deployments in Configuration Manager 2012

Ismail-TS — Thu, 31 May 2012 12:00:51 GMT

How to / Nasıl yaparım:

How to install a State Migration Point (SMP)

To install your State Migration Point do following

1. In the Configuration Manager console, click Administration.

2. In the Administration workspace, expand Site Operations and then click Servers and Site System Roles.

3. Select your Server of interest, right click it and select "Add Site System Roles" from the context menu.

4. At the System role Selection page select State Migration Point

1. You need to select destination folder where user states can be stored.

Log files to monitor the installation progress: SMSSMPSetup.log and smpMSI.log. After a successful installation, you will find information about component state in smpmgr.log file.

How to create a User State Migration Tool Package

Use the following procedures to create your User State Migration Tool (USMT) Package. Per default, User State Migration Tool will be installed during System Center Configuration Manager 2012 Setup and is Part of Windows Automated Installation Kit (WAIK). Therefore, it can be found in "C:\Program Files\Windows AIK\Tools\USMT"

Note: USMT has for each processor architecture a separate subfolder

To create your package

1. In the Configuration Manager console, click Software Library.

2. In the Software Library workspace, expand Overview, then click Application Management and select Packages.

3. In the Packages node, select Create Package

4. Name your Package and select "C:\Program Files\Windows AIK\Tools\USMT" as content source.

Important:

Do not select a subfolder of "C:\Program Files\Windows AIK\Tools\USMT" because the built in step "Capture User State" which executes the scanstate.exe command expects to find the exe file in the folder related to the operating systems process architecture.

5. We do not need to create program for this package as System Center Configuration Manager 2012 utilizes built in commands during a Task Sequence.

6. Do not forget to distribute the content to your Distribution Points.

How to use User State Migration Tool with a State Migration Point

Add required steps to an existing Task Sequence to do the capture

1. In the Configuration Manager console, click Software Library.

2. In the Software Library workspace, expand Overview and then click Operating Systems.

3. In the Task Sequences node, select the task sequence and then click Edit.

4. Now we have two possible options to capture user states:

a. Capture User States in full Operating System or

b. do this in Windows PE Phase

For both options we need these three steps (as a best practice ensure you use a group to keep them related together)

Request State Store

Capture User State

If you want to capture user states in Windows PE you need to tick the checkbox "Capture in off- line mode (Windows PE only)".

Release State Store

This is how it should look like:

Note:

Depending on your decision how to capture user states, ensure you place this group in Windows PE section or in full Operating System section.

Tip:

You might have noticed another new option "Capture by using Volume Copy Shadow Service (VSS)". This option enables the volume shadow-copy service to migrate files that are locked or in use.

Add required steps to an existing Task Sequence to do the restore

1. In the Configuration Manager console, click Software Library.

2. In the Software Library workspace, expand Overview and then click Operating Systems.

3. In the Task Sequences node, select the task sequence and then click Edit.

4. We need these three steps to our task sequence somewhere after the Setup Windows and Configuration Manager step (as a best practice ensure you use a group to keep them related together)

Request State Store

Ensure "Request state from another computer" is selected

Restore User State

Release State Store

This is how it should look like:

How to view Recovery Key information and restore user state

1. In the Configuration Manager console, click Assets and Compliance.

2. In the Assets and Compliance workspace, expand Overview and then click User State Migration.

3. In the User State Migration node, select the System resource of interest and click View Recovery Information.

4. We can see our recovery key and the store location where the data has been captured too.

5. Now we have three possible options to restore this user states

a. Use a custom task sequence with only these three steps

b. Double click the usmt.mig file located on your User state location and type in the Recovery key.

c. Run loadstate.exe with this parameters:

loadstate.exe "\\<servername>\<SMPShareName>\<StateStoreLocation>"
/decrypt /key:<RecoveryKey> /c /all /v:5 /l:"<LogPath>\loadstate.log"
/progress:"<LogPath>\loadstateprogress.log" /i:"miguser.xml" /i:"migapp.xml"

Sample:

How to use User State Migration Tool to store data locally

Create Task Sequence using the "Create task sequence" wizard

1. In the Configuration Manager console, click Software Library.

2. In the Software Library workspace, expand Overview and then click Operating Systems.

3. In the Task Sequences node, select Create Task Sequence.

4. Choose Install and existing image package

5. Name your task sequence, select a Boot Image and click Next

6. Select your image of choice and ensure that Partition and format the target computer before installing the operating system is not selected!

Warning:

If Partition and format the target computer before installing the operating system is selected it will not work!!!

7. Continue the wizard and fill in your information's until you reached the Configure State Migration page.

8. Select Save user settings locally

9. Finish the wizard and edit your new task sequence

10. You might want to use hard-links to do the migration. Therefore you need just to tick the checkbox Capture locally by using links instead of copying files located in the Properties page of your Capture User Files and Settings step.

Source: http://blogs.msdn.com/b/scstr/

Source: http://www.mycloud-tr.com/

İsmail Şen

How to use User Device Affinity

Ismail-TS — Thu, 31 May 2012 11:55:48 GMT

How to / Nasıl yaparım:

Prerequisites for User Device Affinity

The following prerequisites are required for this module:

· DHCP is configured and running

· WDS is installed

· Configuration Manager 2012 is configured for PXE

· Windows 7 installation image is available

How to configure Distribution Point role for User Device Affinity

Use the following procedure to configure the Distribution Point role to support User Device Affinity (UDA). By default the UDA setting will be set to 'Do not allow UDA'.

The following options can be chosen on the PXE tab of the Distribution Point:

· Allow UDA with Auto-Approval- the UDA will be processed during provisioning and automatically approved

· Allow UDA pending Administrator approval- the UDA will be processed during provisioning and await administrator approval

· Do not allow UDA: does not allow UDA to be set during the task sequence

In this exercise we will use the Allow UDA with auto-approval value.

To configure the User Device Affinity on the Distribution point

1. In the Configuration Manager console, click Administration.

2. In the Administration workspace, expand Site Operations and then click Servers and Site System Roles.

3. In the Servers and Site System Roles node, select the Distribution Point on which you want to enable UDA.

4. In the Site System Roles node, select Distribution Point, and then right-click and select Role Properties.

5. In the Distribution Point properties screen, select the PXE tab.

6. On the PXE tab, change the value of the Primary User assignment to Allow UDA with auto-approval

7. Click on OK to apply the changes.

To approve the User Device Affinity request when the UDA setting is set to 'Allow UDA pending Administrator Approval

1. In the Configuration Manager console, click Assets and Compliance.

2. In the Assets and Compliance node click on Device Collections.

3. In the Device Collections node right-click the All Systems collection and click Manage Affinity Requests

4. Click on the User Name and machine combination and select Approve or Reject.

5. Click Close when ready.

Create a simple pre-execution task to query the user for the Primary User of the current machine

In some scenarios it can be useful that the user can reinstall his machine and specify the Primary User of the machine so applications can be pre-deployed to the machine

To modify the boot image to include the pre-execution query

1. In the Configuration Manager console, click Software Library.

2. In the Software Library workspace, expand Operating Systems and then click Boot Images.

3. In the Boot Images node, select the correct Boot Image on which you want to enable the pre-execution hook.

4. On the Boot Image Properties, select the Customization page.

5. Check the box for Enable prestart command hook and type in the following commandline:

a. Wscript.exe UDA.vbs

Content of UDA.vbs:
'Start of Script
UDAUser = Inputbox("Specify your username in DOMAIN\USERNAME FORMAT")

SMSTSAssignUserMode = Auto

set env = CreateObject("Microsoft.SMS.TSEnvironment")

env("SMSTSUdaUsers") = UDAUser

env("SMSTSAssignUsersMode") = SMSTSAssignUserMode

'End of Script

6. Check the box for Include files for the prestart command hook and browse to the following location:

a. \\server\packagesource\pre-hook

7. Click on OK to apply the changes

8. Click on Yes to update the package to all Distribution Points.

9. In the Manage Distribution Point Wizard click next to start updating the boot image.

10. After the image has been update, click on Close to close the wizard.

Source: http://blogs.msdn.com/b/scstr/

Source: http://www.mycloud-tr.com/

İsmail Şen

How to enable Offline Servicing for Operating System Images in Configuration Manager 2012

Ismail-TS — Thu, 31 May 2012 11:53:55 GMT

How to / Nasıl yaparım:

In Configuration Manager 2012 there is a new feature for applying updates to operating system images while they are in the Configuration Manager library. This means any operating system image you see in the Operating Systems > Operating Systems Images node from the Software Library wonderbar can be updated with Component Based Servicing (CBS) updates. By updating an image in the Software Library instead of performing a new build and capture of the operating system image you will gain a few distinct advantages. You will be able to reduce the risk of vulnerabilities during operating system deployments and reduce the overall operating system deployment to the end user. You will also reduce the administrative effort to maintain your operating system images.

The feature is applicable for Component Based Servicing (CBS) updates and for the following operating systems:

Microsoft Windows Vista SP2 and later Microsoft Windows Server 2008 SP2 and later Microsoft Windows 7 SP1 and later Microsoft Windows 2008 R2 SP1 and later

As mentioned previously, offline servicing is available for CBS updates. This will work in coordination with the Configuration Manager Software Updates Point role.

Here are a couple steps to do before we start.

Configure the Software Update Point Deploy updates to you Configuration Manager 2012 clients

Once the first two steps are completed, we can service operating system images in your Configuration Manager library.

From the Software Library wonderbar, select Operating System > Operating System Images Select an image you would like to update. This needs to meet the supported platforms listed above. Select an image then click Schedule Updates from the ribbon.
The Update Operating System Image wizard will appear. A list of updates will be presented. The list contains updates meeting the following criteria: The updates are CBS updates The updates have been downloaded in your Configuration Manager environment. The updates have not successfully been deployed to your image file through the offline servicing feature

These updates are filtered to match the architecture of the image file.

(Illustrated above; The schedule updates wizard presenting updates for a .wim file)

Select the updates you would like to apply to the image. Next set a time for the servicing to occur. Servicing occurs on the site server, so you may want to schedule this off hours.

So now we have set our servicing schedule. Let’s go through the servicing process.

When the schedule time occurs for updating the .wim file, the site server will copy the .wim file from the package source and the appropriate updates from the content library to a temp folder. The site server will mount the .wim file in the temp folder. Through the use of DISM the selected updates are applied to the .wim file. The updates will be applied to all applicable images in the .wim file. Upon success, the wim is restored to the package source location. The original copy of the .wim file preserved as a backup copy to help you easy revert if an update causes any issues. Configuration Manager only retains one back up copy. So the previous back up copy will be removed if it exists. After the process is completed, the update status can be viewed from within the console. In the event of a failure, you will see which updates could not be successfully applied to the .wim file. Additionally, a historical view of the updates can be seen from the image property page.

(Illustrated above; A successful update to a .wim file in the ConfigMgr Software Library. Notice the Update Status tab showing the updates that were processed during the last task.)

(Illustrated above; properties page of an image in the Software Library. All updates that have been successfully installed can be viewed here.)

After the servicing is complete, you will need to still perform an “Update Distribution Point” action on the image. This will ensure the newly updated image is updated and available on assigned distribution points in your ConfigMgr infrastructure.

Source: http://blogs.msdn.com/b/scstr/

Source: http://www.mycloud-tr.com/

İsmail Şen

How to Import Windows Device Drivers

Ismail-TS — Thu, 31 May 2012 11:52:49 GMT

How to / Nasıl yaparım:

Use the following procedure to import Windows device drivers into the driver catalog. Configuration Manager 2012 reads the provider, class, version, signature, supported hardware, and supported platform information associated with the device as part of the import process. By default, the driver is named after the first hardware device it supports, however the device driver can be renamed later. The supported platforms list is determined based on the information in the INF file of the driver. However, the accuracy of this can vary so manually verify if the device driver is supported after it has been imported.

Possible errors during the import process can be reviewed in the DriverCatalog.log log file located in your <InstallationPath>\LOGS folder.

In addition, when importing device drivers you have the option to add the device drivers to device driver packages or to boot image packages.

To import a Windows device driver

1. In the Configuration Manager console, click Software Library.

2. In the Software Library workspace, expand Overview and then click Operating Systems.

3. To start the Import New Driver Wizard, right-click the Drivers node, and then click Import Driver.

4. On the Locate Driver page, specify the following information and then click Next:

· Specify whether you want to import all of the device drivers contained in a specific folder or if you want to select a specific device driver from a folder. The SMS Provider must have read permission to folder or the import will fail.

· To import all of the device drivers from a folder, select Import all drivers in the following network path (UNC) and specify the network path to the device driver folder. For example: \\servername\folder.

· To import a specific driver from a folder, select Import a specific driver and specify the source file folder in UNC format and the Windows device driver .INF or mass storage txtsetup.oem file to be imported.

· Select how you want Configuration Manager 2012 to handle duplicate device drives.

5. On the Driver Details page, specify the following information and then click Next:

· Select the drivers that you want to import.

· To allow computers to use the device drivers, select the Enable these drivers and allow computers to install them check box. This check box is selected by default.

Important:

If a device driver is causing a problem or you want to suspend the installation of a device driver, you can disable the device driver by clearing the Enable these drivers and allow computers to install them check box.

· To assign the device drivers to a category for filtering purposes, such as "Beta" or "Production" categories, click the Categories button and select an existing category or make a new category. The category assignment is also used to configure the device drivers that will be considered by the Auto Apply Driver task sequence step.

6. To add the device driver to a device driver package, on the Add Driver to Packages page, specify the following information and then click Next:

Important:

Assigning a device to a device package is helpful when using task sequences to automate how you deploy an operating system. Device driver packages can be installed as part of a task sequence using the Auto Apply Driver and Apply Driver Package task sequence steps.

· Select the device driver packages that are used to distribute the device driver.

· Optionally, click New Package to create a new device driver package. To create a new device driver package, you must provide a network share that is not being used by other device driver packages.

· To update distribution points when the device drivers are imported, select the Update distribution points when finished check box.

7. To add the device driver to a boot image, on the Add Driver to Boot Images page, specify the following information and then click Next:

Note:

Add only mass storage and network device drivers to the boot images for operating system deployment scenarios.

· Specify the boot images that can install the imported device drivers.

· To update distribution points when the device drivers are imported, select the Update distribution points when finished check box.

8. On the Summary page, review what drivers will be imported, and then click Next.

9. On the Confirmation page, verify that the wizard was successful, and then click OK to exit the wizard.

Source: http://blogs.msdn.com/b/scstr/

Source: http://www.mycloud-tr.com/

İsmail Şen

How to Create Driver Packages

Ismail-TS — Thu, 31 May 2012 11:51:40 GMT

How to / Nasıl yaparım:

Use the following procedure to create a new driver package. Device drivers must to be added to a driver package and distributed to distribution points before Configuration Manager 2012 clients can install them

Important:

To create a device driver package you must have a network folder that is not used by another device driver package. In most cases you must create a new folder before you perform this procedure.

Note:

When using task sequences to install drivers, limit the number of drivers in your driver packages.

· For installing drivers to Windows XP computers, create driver packages that contain less than 150 device drivers.

· For Windows Vista and later, create driver packages that contain less than 500 device drivers.

To create a driver package

1. In the Configuration Manager console, click Software Library.

2. In the Software Library workspace, expand Overview and then click Operating Systems.

3. To start the New Driver Package Wizard, right-click the Driver Packages node, and then click Create Driver Package.

4. In the Name box, specify a descriptive name for the driver package.

5. In the Description box, enter an optional description for the driver package that provides information about the contents or the purpose of the driver package.

6. In the Driver Package Source box, specify an empty source folder for the driver package. Enter the path to the source folder in Universal Naming Convention (UNC) format. Alternatively, click Browse to open the Select Folder dialog box, and then browse to the folder that you want to use for this driver package. Each driver package must use a unique folder.

Important:

The Configuration Manager 2012 System account must have Read and Write permissions to the specified driver package source folder.

The new driver package does not contain any drivers. The next step is to add drivers to the package.

If the Driver Packages node contains several packages, you can add folders to the node to separate the packages into logical groups.

To view the associated general, data source, distribution point, data access, and security information for the driver package, click Properties.

How to Add or Remove Device Drivers to Device Driver Packages

Use the following procedures to add device drivers to device driver packages or to remove device drivers from device driver packages. To add or remove device drivers you must locate the drivers in the Drivers node and then edit which packages the driver is associated with.

To add device drivers to device driver packages

1. In the Configuration Manager console, click Software Library.

2. In the Software Library workspace, expand Overview and then click Operating Systems.

3. In the Drivers node, right-click the device drivers that you want to add to the package.

4. Click Edit, and then click Driver Packages to open the Add or Remove Drivers to Packages dialog box.

5. Select the check box of the driver packages that you want to add the device drivers to. You can create a new package by clicking New Package to open the New Driver Package Wizard.

6. To close the Add or Remove Drivers to Packages dialog box, click OK.

To remove device drivers from a device driver package

1. In the Configuration Manager console, click Software Library.

2. In the Software Library workspace, expand Overview and then click Operating Systems.

3. In the Drivers node, right-click the device drivers that you want to remove.

4. Click Edit, and the click Driver Packages to open the Add or Remove Drivers to Packages dialog box.

5. Clear the check box associated with the driver packages that you want to remove the device drivers from.

6. To close the Add or Remove Drivers to Packages dialog box, click OK.

How to Delete a Device Driver

Use the following procedure to delete a device driver. Device drivers must be deleted one device driver at a time.

To delete a device driver

1. In the Configuration Manager console, click Software Library.

2. In the Software Library workspace, expand Overview and then click Operating Systems.

3. Select the device driver in the Drivers node and click Delete.

4. In the Delete Driver dialog box confirm the device driver to delete. Click Show References to display the device driver packages and boot images that are associated with the selected device driver.

5. Click OK to delete the device driver and close the Delete Driver dialog box.

How to Enable and Disable Device Drivers

Use the following procedures to disable and enable device drivers. By default device drivers are enabled when they are imported into the driver catalog. You can temporarily disable device drivers so that Configuration Manager 2012 client computers and task sequences cannot install them when deploying operating systems.

To disable device drivers

1. In the Configuration Manager console, click Software Library.

2. In the Software Library workspace, expand Overview and then click Operating Systems.

3. In the Drivers node, select the device drivers that you want to disable, and then click Disable.

4. In the Update Driver Status dialog box, confirm which device drivers will be disabled, and then click Yes.

To enable device drivers

1. In the Configuration Manager console, click Software Library.

2. In the Software Library workspace, expand Overview and then click Operating Systems.

3. In the Drivers node, select the device driver that you want to enable, and then click Enable.

4. In the Update Driver Status dialog box, confirm which device drivers will be enabled, and then click Yes.

How to install a Device Driver using Task Sequences

You can add new device drivers to an existing operating system image using the task sequence editor. You can specify which device driver to install, you can allow Configuration Manager 2012 to search the driver categories to determine which driver to install, or you can specify a specific device driver or device driver package.

Use the procedure below to add device drivers to an existing operating system image using one of the following Driver task sequence steps:

· Auto Apply Drivers

· Apply Driver Package

To add a device driver to an operating system image using task sequences

1. In the Configuration Manager console, click Software Library.

2. In the Software Library workspace, expand Overview and then click Operating Systems.

3. In the Task Sequences node, select the task sequence and then click Edit.

4. Select the task sequence group that you want to add the driver task sequence step to, or click Add and then select Drivers.

5. To allow Configuration Manager 2012 to search for the appropriate device drivers, add the Auto Apply Drivers task sequence step. Configuration Manager 2012 will search the available driver categories for the appropriate device drivers.
To allow Configuration Manager 2012 to add a driver package, add the Apply Driver Package task sequence step. This option will allow Configuration Manager 2012 to install only device drivers from a specific category.

6. Specify the appropriate information on the Properties and Options tabs.

7. Click OK to save the task sequence.

Source: http://blogs.msdn.com/b/scstr/

Source: http://www.mycloud-tr.com/

İsmail Şen

Creating Media for Task Sequences

Ismail-TS — Thu, 31 May 2012 11:50:19 GMT

How to / Nasıl yaparım:

Stand-alone media

Bootable media

Capture media

Prestaged media

You can write task sequences and their related files and dependencies to a DVD or CD set or a USB flash drive. Using removable media allows you to run the task sequence on computers that do not have a network connection to your Configuration Manager 2012 site. Task sequence media can be used anywhere in the hierarchy.

You can create the following types of removable media:

Stand-alone Media:

Stand-alone media contains the task sequence and all associated objects that are necessary for the task sequence to run. Stand-alone media task sequences can run when Configuration Manager 2012 has limited or no connectivity to the network. Stand-alone media can be run in the following ways:

· If the destination computer is not booted, the Windows PE image associated with the task sequence is used from the stand-alone media and the task sequence begins.

· The stand-alone media can be manually started if a user is logged on to the network and initiates the installation.

Important:

The steps of a stand-alone media task sequence must be able to fully run autonomously from the network; otherwise, the task sequence step will fail. For example, a task sequence step that requires a distribution point to obtain a package or need to talk back to the MP to get additional information dynamically will fail. Common steps that are affected are: Install Software Updates, Install applications according to dynamic variable list and Auto-Apply Drivers; however if the necessary package is contained on the stand-alone media the task sequence step will succeed.

This media can be created using the create task sequence media wizard located in software library - operating systems - task sequences.

Select Stand-alone media

Choose if you want to create a CD/DVD or USB flash drive
You might want to set a password to protect the media

Select your task sequence you want to create the media for
Select a distribution point that hosts all packages referenced by the task sequence

Add variables with values you need for your deployment. If a variable has an empty value you will be asked to type in a value before you can start the deployment. Notice: prestart commands can be enabled as well.

After booting this media you need to type in the password. You can configure a static IP address using the Configure Network Settings

Confirm to run the task sequence

As configured before we have to type in a value for variable OSDComputerName. Now you can run your task sequence.

Bootable Media:

Bootable Medias contain the necessary files to start a destination computer so that it can connect to the Configuration Manager 2012 infrastructure and determine which task sequences to run based on its membership to a collection. The task sequence and dependent objects are not contained on the media; instead, they are obtained over the network from the Configuration Manager 2012 client. This method is useful for new computer or when no Configuration Manager 2012 client is present on the destination computer and no PXE Service point is available in the environment. In Configuration Manager 2012 it is now possible to provide a list of Management Points that can be contacted to get the Task Sequences advertised to the System. Furthermore, we now have the option create an internet-based media, which will contact an internet based management point.

Select Bootable media

Choose if this should become a Dynamic media or a Site-based media. A Dynamic media is able to contact several MP's provided during media creation.
Choose if you want to create a CD/DVD or USB flash drive

Decide to enable unknown client support, protect the media with a password or allow User device affinity.

Select your Boot image and provide the list of associated management points

Add variables with values you need for your deployment. Prestart commands can be enabled as well.

Type in the password to continue

Select the task sequence you want to execute

Capture Media:

Capture Medias allow capturing an operating system image created outside the Configuration Manager 2012 infrastructure. Capture media will prompt the user for input values like the image file destination location. If a Configuration Manager Client Agent is installed on the System, the Capture Media will ensure that it is sysprepped like the Operating System.

Select Capture media

Choose if you want to create a CD/DVD or USB flash drive

Select your boot image you want to use. Notice: No matter which processor architecture you plan to capture you can use both types x86 and x64 boot images. Sysprep will be executed in Full OS and except for Windows XP run from C:\Windows\System32\sysprep folder. If a Windows XP Installation should be captured you need to manually copy the files from deploy.cab file (located on installation media) to c:\Sysprep directory before you start the wizard of the capture media.

Run the wizard

Select destination to capture the image file to (can be the local disk drive as well)

Prestaged Media:

Prestaged Medias are hybrid wim files containing the Operating System image and a Bootable Media. It's booting into the Bootable Media part accessing the Configuration Manager 2012 infrastructure and running available Task Sequences. When the task sequence is executing the "Apply Operating System" step it will recognize an already applied operating system and will immediately continue at the next step. This is the perfect solution to be able to hand over this Image to the OEM vendor of your systems to have your corporate image pre-applied.

Select Prestaged media

Choose if this should become a Dynamic media or a Site-based media. A Dynamic media is able to contact several MP's provided during media creation.

choose where to create the prestaged media file.

As mentioned before a prestaged media file is a hybrid wim which needs to be applied on a target system. This can be done using a task sequence exported on a stand-alone media or using a windows PE to apply the image with dism or imagex.

Warning:

If you decide using a task sequence to apply the image never use the apply operating system step because it will mess up the preconfigured BCD store and the system will not boot into Windows PE.

When you create media, specify a password for the media to control who has access to the files that are contained on the media. If you specify a password, a user must be present to enter the password at the destination computer when the task sequence runs.

When you run a task sequence by using media, the specified computer chip architecture contained on the media will not be recognized and the task sequence will attempt to run even if the architecture specified does not match what is actually installed on the destination computer. If the chip architecture contained on the media does not match the chip architecture installed on the destination computer, the installation will fail.

Source: http://blogs.msdn.com/b/scstr/

Source: http://www.mycloud-tr.com/

İsmail Şen

How to SCUP 2011 Installing and Integration to SCCM 2012

Ismail-TS — Thu, 31 May 2012 11:48:07 GMT

How to / Nasıl yaparım:

· Download SCUP 2011 from this link - http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=11940

· Locate SystemCenterUpdatesPublisher.msi and double click on it to start the installation of SCUP 2011.

· Click "Install Microsoft Windows Server Update Services 3.0 Sp2 hotfix" if it is not installed already and click Next to continue

· Accept the License Agreement and click Next until you reach Finish option.

Importing updates to SCUP 2011

· Once SCUP 2011 is installed successfully then connect to SCUP 2011 console

· Choose "Specify the path to the catalog to import" (choose the CAB file path you imported in earlier section from SCUP 4.5)

· Choose Next until you see the successful message of imported updates

Configuring SCUP 2011

· Connect to SCUP 2011 console and choose "Options"

· Check "Enable publishing to an update server" option under "Update Server" tab

· If Update server is local then choose "Connect to a local update server" else choose "Connect to a remote update server" and specify the name and port number

· Click on "Test Connection" and make sure it is able to connect successfully

· Under "ConfigMgr Server" tab, check "Enable Configuration Manager integration" option and choose local or remote ConfigMgr server accordingly. Again, click on "Test Connection" to make sure it is able to connect successfully.

· Set Proxy Settings and other options under Advanced tab according to your environment.

Setting up GPO to deploy Certificate

Creating GPO for the domain

Important:

If you already had deployed Certificate during SCUP 4.5 and if it is not expired then you don't have to re-deploy and do not need to go through this process. This only applies if you never deployed SCUP 4.5 and are installing SCUP 2011 for the first time.

· Connect to Group Policy Management through MMC

· Browse through the Domain and right click and choose "Create a GPO in this domain, and Link it here…" option

· Fill out the Name and Source Starter GPO information

· Right click on that GPO you just created and click "Edit"

· Go to Computer Configuration à Policies à Administrative Templates à Windows Components à Windows Update à "Allow signed updates from an intranet Microsoft update service location" àEnabled

· Once you create above GPO then refresh group policy on any client which is part of the domain and check the following registry key to make sure this GPO has been applied properly:

HKLM à Software à Policies à Microsoft à Windows à Windows Update à AcceptTrustedPublisherCerts and the value for this REG_DWORD is set to 1 as shown below:

Creating Package/Program for distribution of Certificate to client systems

Important:

You need to deploy certificate to all of the systems that are ConfigMgr clients in your environment.

· Create Package with the following files as a source:

1. Certutil.exe (This file is part of Windows 2003 server and located under %windir%\system32, by default.)

2. Certadm.dll (This file is part of Windows 2003 server and located under %windir%\system32, by default.)

3. SCUPCert.cer (This file is the one you exported from WSUS server)

4. Create a program (to store certificate to TrustedPublisher) using the following options and command line:

· Command Line: certutil.exe -addstore TrustedPublisher SCUPCert.cer

· Run: Hidden

5. Create a second program (to store certificate to the Root) using the following command line and options (i.e. dependency chain with first program):

· Command Line: certutil.exe -addstore Root SCUPCert.cer

· Run: Hidden

6. Deploy "SCUP 2011 Cert Root program" as this root program is running another program first.

7. Once you are done with deployment of the certificate then you will be able to deploy SCUP updates to your ConfigMgr environment. You can also add partner catalog right from the SCUP console using the process defined in the following section.

Adding and deploying partner catalog

· Connect to SCUP 2011 console and click on "Add Partner Software Updates Catalogs"

· Highlight the catalog and click on Add

· Go to Catalogs tab and you will see the list of catalogs. Highligt the one you want to import and right click and choose "Import"

· Follow the wizard by clicking Next

· Once 3^rd party catalog is successfully imported into SCUP then you need to publish those updates so that they can be synced with ConfigMgr

· Click on Updates tab and choose the updates you want to publish as shown below

· Choose appropriate publish options as shown below and follow the wizard to complete the publish process

· Once Updates are published then you can sync them with ConfigMgr using ConfigMgr console. Once they are in ConfigMgr console then those updates are available for deployment just like any other Microsoft updates

· To run the sync, connect to the ConfigMgr 2007 console and browse through Software Updates node and right click on "Update Repository" and choose "Run Synchronization" option

· Review WsyncMgr.log and notice the following:

· Once they are successfully synchronized with ConfigMgr then you will be able to see it in the console and able to deploy them just like any other updates.

Source: http://blogs.msdn.com/b/scstr/

Source: http://www.mycloud-tr.com/

İsmail Şen

How to Create a Windows Firewall Policy

Ismail-TS — Thu, 31 May 2012 11:44:01 GMT

How to / Nasıl yaparım:

1. In the Configuration Manager console, click Assets and Compliance.

2. In the Assets and Compliance workspace, expand Endpoint Protection, and then click Windows Firewall Policies.

3. On the Home tab, in the Create group, click Create Firewall Policy.

4. On the General page of the Create Firewall Policy Wizard, specify a name and an optional description for this firewall policy, and then click Next.

5. On the Profile Settings page of the wizard, configure the following settings for each network profile:

Note

For more information about network profiles, see your Windows documentation.

 Enable Windows Firewall

Note

If Enable Windows Firewall is not enabled, the other settings on this page of the wizard will be unavailable.

 Block all incoming connections, including those in the list of allowed programs:

 Notify the user when firewall blocks a new program:

6. On the Summary page of the wizard, review the actions to be taken, and then complete the wizard.

7. Verify that the new Windows Firewall policy displays in the Windows Firewall Policies list.

To Deploy a Windows Firewall Policy

1. In the Configuration Manager console, click Assets and Compliance.

2. In the Assets and Compliance workspace, expand Endpoint Protection, and then click Windows Firewall Policies.

3. In the Windows Firewall Policies list, select the Windows Firewall policy that you want to deploy.

4. On the Home tab, in the Deployment group, click Deploy.

5. In the Deploy Windows Firewall Policy dialog box, specify the collection that you want to assign this Windows Firewall policy to, and specify an assignment schedule. The Windows Firewall policy evaluates for compliance by using this schedule and the Windows Firewall settings on clients reconfigure to match the Windows Firewall policy.

6. Click OK to close the Deploy Firewall Policy dialog box and to assign the Windows Firewall Policy.

Important

When you deploy a Windows Firewall Policy to a collection, this policy is applied to computers in a random order over a 2 hour period to avoid flooding the network.

Source: http://blogs.msdn.com/b/scstr/

Source: http://www.mycloud-tr.com/

İsmail Şen

How to SCEP & Settings & Automatic Deploymnet Rule

Ismail-TS — Thu, 31 May 2012 11:21:17 GMT

How to / Nasıl yaparım:

Enabling the EP Role

To install and configure the Endpoint Protection Point Role for the Central Administration Site:

1. In the Configuration Manager console, click Administration.

2. In the Administration workspace, expand Site Configuration and click Servers and Site System Roles.

3. On the Home tab, double click Add Site System Roles. The Add Site System Roles Wizard opens.

5. On the General page, specify the general settings for the site system server and click Next.

6. On the System Role Selection page, select Endpoint Protection Point from the list of available roles, and then click Next.

7. On the Enrollment Proxy Point page, make sure the information is correct, and then click Next.

8. On the Specify Endpoint Protection License Page, accept the license and click Next.

Important:

License agreement is required to use System Center Endpoint Protection product.

9. On the Specify Microsoft Spynet membership type, choose membership type and click Next.

Important:

On this page, the Admin chooses his overall Spynet settings, which are applied to all out-of-box AM policies.

10. On the Confirm Settings page, click Next.

11. On the Completion Page, click Close.

Verify that the Endpoint Protection Point role has been added as a Site Server Role:

1. In the Configuration Manager console, click Administration.

2. In the Administration workspace, expand Site Configuration and click Servers and Site System Roles.

3. In the Dashboard area at the bottom, you should see the Endpoint Protection Point listed as one of the Site System Roles.

Enable EP Client

Enable the EP Client with the following settings:

· Install SCEP on clients – Yes

· Remove previously installed antimalware software – Yes

· Suppress reboot is required after the client is installed – No

· Postpone restart no longer than “9 hours”

· Disable alternate sources – No

Enabling the System Center Endpoint Protection (SCEP) Client

1. In the Configuration Manager console, click Administration.

2. Click on “Client Settings”.

3. On the Home tab, click on “Create Custom Client Device Settings”.

4. The “Custom Device Settings” property screen comes up.

5. Enter “Endpoint Protection Settings” as the Name.

6. Enter “Endpoint Client Protection Settings for the domain” as the Description.

7. Check the “Endpoint Protection” box.

8. Click on “Endpoint Protection”.

9. For “Manage Endpoint Protection client on client computers”, toggle this setting to “True”.

10. For “Install Endpoint Protection on clients”, verify this setting is set to “True”.

11. For “Automatically remove previously installed antimalware software before Endpoint Protection is installed”, verify this setting is set to “True”.

12. For “Suppress any required computer restarts after End Point client installed”, toggle this setting to “False”.

13. For “Allowed period of time users can postpone a required restart to complete the Endpoint Protection client is installed” change this setting to “9”.

14. For “Disable alternate sources”, toggle this setting to “False”.

15. Click on OK.

To verify your EP Client settings:

· In the Configuration Manager console, click Administration.

· Click on “Endpoint Client Protection Settings”.

· Right click on “Endpoint Protection Settings” and select Properties.

· Click on “Endpoint Protection” and verify your settings are there.

· Click OK to close.

Create a Custom AntiMalware Policy

When you enable Endpoint Protection, a default antimalware policy is applied to client computers and you can use additional policy templates that are supplied or create your own custom antimalware policies to customize the settings for your environment.

Important

If you create a new antimalware policy for a collection, this antimalware policy overrides the default antimalware policy.

To create a new Custom antimalware policy

1. In the Configuration Manager console, click Assets and Compliance.

2. In the Assets and Compliance workspace, click Endpoint Protection, and then click Antimalware Policies.

3. On the Home tab, in the Create group, click Create Antimalware Policy.

4. In the General section of the Create Antimalware Policy dialog box, specify a name and description for the policy.

5. In the Create Antimalware Policy dialog box, configure the settings that you require for this antimalware policy, and then click OK.

6. Verify that the new antimalware policy displays in the Antimalware policies list.

To import an antimalware policy

1. In the Configuration Manager console, click Assets and Compliance.

2. In the Assets and Compliance workspace, click Endpoint Protection, and then click Antimalware Policies.

3. In the Home tab, in the Create group, click Import.

4. In the Open dialog box, browse to the policy file that you want to import, and then click Open.

5. In the Create Antimalware Policy dialog box, review the settings to use, and then click OK.

6. Verify that the new antimalware policy displays in the Antimalware policies list.

To deploy an antimalware policy to client computers

1. In the Configuration Manager console, click Assets and Compliance.

2. In the Assets and Compliance workspace, click Endpoint Protection, and then click Antimalware Policies.

3. In the Antimalware Policies list, select the antimalware policy that you want to deploy and then, on the Home tab, in the Deployment group, click Deploy. In the Select Collection dialog box, select the device collection that you want to deploy the antimalware policy to, and then click OK

Create ADR for Definitions

Configure Configuration Manager Software Updates to Deliver Definition Updates to Client Computers

You can configure Configuration Manager software updates to deliver definition updates to client computers by configuring automatic deployment rules. Before you start, ensure that you have configured Configuration Manager software updates. For more information, see Software Updates in Configuration Manager.

To configure an automatic deployment rule to deliver definition updates

1. In the Configuration Manager console, click Software Library.

2. In the Software Library workspace, expand Software Updates and then click Automatic Deployment Rules.

3. On the Home tab, in the Create group, click Create Automatic Deployment Rule.

4. On the General page of the Create Automatic Deployment Rule Wizard, specify the following information:

· Name: Specify a unique name “FEP Definition ADR” for the automatic deployment rule.

· Collection: Choose the collection of client computers that you want to deploy definition updates to.

Note You cannot deploy definition updates to a collection of users.

5. Select Add to an existing Software Update Group.

6. Select Enable the deployment after this rule is run, and then click Next.

7. On the Deployment Settings page of the wizard, from the Detail level drop-down list, select Minimal, and then click Next.

Note

Choose Minimal to reduce the number of state messages returned by definition deployment. This configuration helps to reduce the CPU processing usage on the Configuration Manager servers.

8. On the Software Updates page of the wizard, select “Update Classification” and “Product” from the Property filters list.

9. In the Search criteria list, click on Product and select <Forefront Endpoint Protecti\on 2010>, and then Okay, for <Update Classification> from the “items to find” drop-down list select “<Definition Updates>” and <Updates> Click Next.

10. On the Evaluation Schedule page of the wizard, select Enable rule to run on a schedule and then configure the schedule at which definition updates will be downloaded. Set the rule to run every 8 hours after each software update point synchronization. Click OK and then Click NEXT.

11. On the Deployment Schedule page of the wizard, configure the following settings:

· Time based on: Select UTC if you want all clients in the hierarchy to install the latest definitions at the same time. This setting is a recommended best practice.

· Specific time: Specify the time for the automatic deployment rule to run. You must allow a minimum of 1 hour to ensure that content for the deployment has time to reach distribution points in your hierarchy. Some definition updates might also include antimalware engine updates, which might take longer to reach distribution points.

· Installation deadline – Select As soon as possible.

Note

Software update deadlines are randomized over a 2 hour period to prevent all clients from requesting an update at the same time.

12. Click Next.

Note:

Software updates that have been deployed by using an automatic deployment rule are automatically deployed to new clients added to the target collection.

Important:

Deployments can be enabled or disabled at any time for the automatic deployment rule.

13. On the User Experience page of the wizard, select Hide in Software Center and all notifications from the User notifications drop-down list to ensure that definition updates install silently. Click Next.

14. On the Alert page, accept the defaults. Click Next.

15. On the Download Settings page, accept the defaults. Click Next.

Important:

You have to create a share on a machine for the package to be downloaded to.

16. On the Deployment Package page, select “Create a new deployment package”.

- Name enter “ SCEP Definitions”

- Description – enter “Deployment Package for SCEP Definitions

17. Browse to the share that you created to hold the package. Click Next.

18. On the “Distribution Points” page, click on Add.

19. On the “Add Distribution Points” page, check the Distribution Point that you will use. Click OK. Click Next.

20. On the ”Download Location” page, click Next.

21. On the “Language Selection” page, uncheck everything except “English”. Click Next.

22. On “Confirm the settings” page, click Next.

23. On the “Completion” page, click Close.

Source: http://blogs.msdn.com/b/scstr/

Source: http://www.mycloud-tr.com/

İsmail Şen