Larus

Create update lists using a reference system and Right-Click

Larus Milan Bulat — Tue, 03 Nov 2009 16:45:00 GMT

Uptate lists are nice to have but I wish the query engine behind Update Search Folders were more useful, a very common task is to create an update list from a Reference system but there seems to be no easy way of doing that. WQL would be a nice option here.

One solution is to run this brilliant PowerShell script made by Joachim http://cid-dc43b6dbf64a5be0.spaces.live.com/blog/cns!DC43B6DBF64A5BE0!113.entry

But I wanted it to be even easier than that so I modified the console to add a Right-Click option.

Save the PowerShell script as %windir%\system32\Create-UpdateList.ps1
Run PowerShell.exe
Set-ExecutionPolicy Unrestricted (Note: potential security risk)
Then Exit
Create “\Microsoft Configuration Manager\AdminUI\XmlStorage\Extensions\Actions\7ba8bf44-2344-4035-bdb4-16630291dcf6\UpdateActions.XML”
Restart the SCCM Console

UpdateActions.XML:
<ActionDescription Class="Group" DisplayName="Update Actions" MnemonicDisplayName="Client Actions" Description="Update Actions" SqmDataPoint="53">

<FilePath>powershell.exe</FilePath>

<Parameters>Create-UpdateList.ps1 -ReferenceClient ##SUB:Name## -UpdateListName Ref-##SUB:Name##</Parameters>

</Executable>

</ActionDescription>

</ActionGroups>

</ActionDescription>

Now you can just Right Click the Reference system, select the new action to create a Update List with all fixes applicable to that system, then you can use drag-and-drop into the Update List you are using to generate or maintain a deployment.

SCCM discovery custom attributes.

Larus Milan Bulat — Wed, 25 Mar 2009 10:21:00 GMT

One thing I'm often asked about is how to type in specific data into SMS/SCCM, add an asset number to a system for example, since SMS/SCCM has no such feature most of us just store the data on the clients registry and pull it back by modifying the SMS_DEF.MOF.

Custom discover attributes are how ever an option that now allows us to use AD as a place to type in simple asset information.

But there are other data we might be interested to retrieve like when did a computer account change it's password in AD, this can be valuable when troubleshooting client and advertisement problems.

Adding the custom attributes that you want to collect is simple, just press the asterisk and type in the name of the attribute:

The LDAP attribute is not stored in a normal date format so it has to be converted in your report:

SELECT Netbios_Name0 AS [System Name], Description0 AS Description, DATEADD(minute, (CONVERT(bigint, pwdLastSet0) - 47966688000000000) / 600000000.0, '17530101') AS [Password Last Changed] FROM v_R_System

(Conversion made by Michael Valentine Jones found in this tread: http://www.sqlteam.com/forums/topic.asp?TOPIC_ID=108759)

Injecting IDE mass storage drivers into XP images in SCCM

Larus Milan Bulat — Sat, 19 Apr 2008 11:43:00 GMT

SCCM has a fantastic feature to achieve the goal of a single image for XP, it is to inject Mass-storage drivers into the image after it has been applied, there is however one snag, SCCM can for some reason only import drivers where the .INF file where the Class=SCSIAdapter.

Most IDE drivers however have Class=hdc, fortunately you can just change the class and then import the driver, this will then be fixed in SP1 so there should be no need for this in the future.

Then there is another problem, if the driver you are import has no TxtSetup.OEM you will not get the option of injecting the driver and there are no plans to support that as far as I know.

SMBIOS GUID/UUID problems in SCCM OSD

Larus Milan Bulat — Fri, 18 Apr 2008 09:34:00 GMT

When deploying a image to baremetal in SCCM you need to create a DDR since the Task Sequence is like any other deployment, that is a an advertisement targetting a resource in SMS.

How this works in the background however is that the Task Sequence uses the SMBIOS UUID to match the advertisement policy and chain the Task Sequence to the same system during the reboots needed for the whole process and computer association. So even if you import a record using only the new name of the system and the MAC address the the UUID will be used.The SMBIOS GUID/UUID is not the same as SMS GUID and should be hardcoded and unique just like MAC of a network card, this however is not always the case.If there is a problem with the UUID's on your systems you will run into problems:

UUID is empty: The Task Sequence will crash.

Duplicate UUID: The Task Sequence fails because there is already a system in the SCCM database with the UUID and there is no advertisement policy for that system or UUID.

If the Task Sequence fails because no advertisement can be found you can find out if this is the problem by starting the Boot Media with Command Prompt enabled and read through the smsts.log located under %temp%\smsts:

No assigned task sequence. TSMBootstrap 2/8/2008 5:18:11 PM1480 (0x05C8)

Search above this error above the Processing Policy Assigments for a line similar to this:

Client GUID = GUID:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx. Netbios Name = ABC

If ABC is a different name than you imported then this one has the same UUID. You can search for duplicates of systems already having a client by running this SQL query:

SELECT SMBIOS_GUID0, COUNT(SMBIOS_GUID0) AS CountFROM v_R_SystemGROUP BY SMBIOS_GUID0, Active0, Client0, Obsolete0HAVING (Active0 = 1) AND (Client0 = 1) AND (Obsolete0 = 0) AND (COUNT(SMBIOS_GUID0) > 1)

If you have duplicates you can either create a stand alone media or contact the PC manufacturer and ask for a tool to fix the UUID If there is no UUID then the plan fix that in SCCM 2007 sp1, not I've not tested that yet.

Delta package replication problems in SMS 2003

Larus Milan Bulat — Mon, 01 Oct 2007 12:03:00 GMT

There can be many reasons for package replication in a large hierarchy to fail, the compressed package files may not exists anymore on the child site, antivirus may have blocked files in the scheduler on a parent or because of problems fixed with few hotfixes in SP2.

The symptom can be that the latest version of the package does not reach your DP's or the package just does not appear or reappear and the package status shows install pending.
Figuring out if you actually have a problem is not so easy because large package assigned to a DP on the other site of the planet may have to go through number of sites and very slow links, so it may be normal to wait for more than a day.

How to identify the problem:

By running this query on the site where the package was created:
SELECT PkgStatus.* FROM PkgStatus WHERE (Type = 1) AND (ID = '<PackageID>') AND (SiteCode = '<SiteCode>')
When Status<>0 and SourceVersion>0 you may have a problem but only if persistent over long period of time, this can be a normal state where the size of the package and available bandwidth causes the delay,
The distmgr.log on the child site managing the DP contains entries like this, this is a normal state until the PCK files arrive, but will continue forever if there is a problem and the PCK files are never send:
Package <PackageID> requires a newer version (3) of source files and the new compressed files haven't arrived yet, current version is 2.
The despool.log on the child site managing the DP contains entries like this showing that a delta has been created with version 3 but version 2 cannot be found, the PCK files may have been deleted:
Received package <PackageID> version 3
CCompress::Open: Failed to open X:\SMSPKG\<PackageID> (2)

Solutions:

There are few possible methods of repairing this covered in this article which can be defined as a supported methods: http://www.blogcastrepository.com/blogs/mattbro/articles/687.aspx
These methods may not always work and do also require you to either copy large PCK files over those slow links without any bandwidth control or by burning them onto a DVD to be sent.

The unsupported method which has always worked for me is to reset the delta replication values by changing entries in the database, the compressed PCK file will then be replicated using the SMS bandwidth control you have already put in place and should then not saturate your WAN links.

WARNING, modifying tables in the SMS database is not supported and should be tested in your testlab.

Replace <PackageID> with the package ID of the package with the problem and <SMSChildSite> with the name of the Site server managing the DP's, not the DP's them self:
UPDATE PkgStatus SET Status = 2, SourceVersion = 0 WHERE (ID = '<PackageID>') AND (Type = 1) AND (PkgServer = '<SMSChildSite>')

When this has been done you must trigger that the PCK files are replicated by refreshing the DP’s of the package in the SMS Admin console.

4GB WIM file size limit when deploying a Captured XP Image on a DVD in BDD 2007

Larus Milan Bulat — Thu, 26 Apr 2007 11:43:00 GMT

When trying to create a bootable DVD to install a backup of a system I thought the easiest way would be to use BDD 2007 but that turned out to be more difficult than I expected..
When the WIM image file is larger than 4GB OSCDIMG.EXE fails generating the ISO file because of restriction of the max file size on DVD.
One would think by using ImageX.exe to split the WIM file would solve the problem but unfortunately importing split WIM files is not supported in BDD 2007.
But with little cheating we can trick the Deployment Workbench.

I‘ve set the same name for all objects and directory names “ImageDeploy” just to simplify, when splitting the WIM file use the same filename in the prefix so the modified script can use the split files.

Backup and modify “Drive:\Distribution\Scripts\LTIApply.wsf” as shown at the bottom of this page .
Split the WMI file: imagex.exe /check /split ImageDeploy.wim ImageDeploy.swm 4000
Create a Operataing System as Custom Image file and choose the captured WIM file.
Replace the WIM file with the SWM files in "Drive:\Distribution\Operating Systems\ImageDeploy"
Create a new build
Create a new Deployment point as Removable media
Perform "Update (files only)" the deployment point
Make sure the old WIM file can not be found in either "Drive:\Distribution\Operating Systems\ImageDeploy" or "Drive:\<ImageDeploy>\Content\Deploy\Operating Systems\<ImageDeploy>"
Perform "Update" the deployment point to generate the ISO file

Note that this only applies to XP images, Vista is handled differently in the script and I may work on that later.

Also keep this in mind when applying XP images using BDD 2007:
http://www.deployvista.com/Blog/tabid/70/EntryID/17/Default.aspx

LTIApply.wsf changes:
Locate lines 551, 555 and 578 for modifications,

'Lalli, added splitfile detection

If not oFSO.FileExists(sImagePath) then

if not oFSO.FileExists(Left(sImagePath, Len(sImagePath)-4) & ".swm") then

oUtility.ValidateConnection sImagePath

End if

'Lalli, added splitfile detection

If not oFSO.FileExists(sImagePath) then

If not oFSO.FileExists(Left(sImagePath, Len(sImagePath)-4) & ".swm") then

oLogging.CreateEntry "Image file " & sImagePath & " does not exist, aborting", LogTypeError

ApplyImage = Failure

Exit Function

End if

' Clean off old OS if running in PE

If oEnvironment.Item("OSVersion") = "WinPE" then

CleanDrive

End if

' Apply the new image

iRc = oUtility.FindFile("imagex.exe", sImageX)

If iRc <> Success then

oLogging.CreateEntry "ERROR: Unable to find ImageX", LogTypeError

ApplyImage = Failure

Exit Function

End if

'Lalli, added splitfile detection

If oFSO.FileExists(Left(sImagePath, Len(sImagePath)-4) & ".swm") then

sCmd = "cmd /c """"" & sImageX & """ /ref """ & Left(sImagePath, Len(sImagePath)-4) & "*.swm" & """ /apply """ & Left(sImagePath, Len(sImagePath)-4) & ".swm" & """ " & sImageIndex & " C:\ >> " & oUtility.LogPath & "\LTIApply_imagex.log 2>&1"""

Else

sCmd = "cmd /c """"" & sImageX & """ /apply """ & sImagePath & """ " & sImageIndex & " C:\ >> " & oUtility.LogPath & "\LTIApply_imagex.log 2>&1"""

End if

MPTroubleshooter case sensitive

Larus Milan Bulat — Fri, 20 Apr 2007 08:18:00 GMT

MPTroubleshooter seems to be case sensitive when it comes to the name of the site system during Post-Installation check, not sure if this began after W2003 SP1 was applied or maybe I have never run it agains this one.

I could not find any problems with the MP it self, it was providing policies and processing incoming data

The errors returned were actually not true.

"All MPs listed in SQL do not match the return of the MPlist query" which was not true when comparing http://server/sms_mp/.sms_aut?mplist the list returned from this MP against the one on a secondary child that was not failing in the MPTroubleshooter.

The MPTroubleshooter also stated that the MP was not in the SMS_SiteSystemToSQLConnection_<site> group of the site server which was also untrue.

The MP had been created as a site system in SMS using lower case in the name which was different from all the others not showing any errors when tested. Recreating the system DSN on the MP system to match the case did not help, only by removing the MP and recreating using upper case letters in the name resolved the issue.

MMC cannot open the file drive:\SMS\bin\i386\sms.msc

Larus Milan Bulat — Fri, 02 Feb 2007 09:05:00 GMT

"MMC cannot open the file drive:\SMS\bin\i386\sms.msc
This may be because the file does not exist, is not an MMC console, or was created by a later version of MMC. This may also be because you do not have sufficient rights to the file."

I've seen this few time over the years but everytime I forget and I can never find anything useful on the internet. This seems to happen if your TSE session has to be killed having the SMS admin console running, other admins have no problems on the same server and you have no problems on other servers in the hierarchy so it must be something in your profile.

The resolution is to rename a file in drive:\Documents and Settings\username\Application Data\Microsoft\MMC\SMS. to something else and then start up the SMS Admin console again for it to be recreated.

SMS 2003 Device Management Feature Pack DMFP

Larus Milan Bulat — Sat, 20 Jan 2007 09:50:00 GMT

Not much information can be found about this feature pack for SMS 2003 but I’ve seen some interest on this subject on newsgroups so I though I would share some of my experience with you based on a project I did here in the UK for one of my clients, this project started before WinCE 5 but most of it should still be relevant.

Customer requierements:

Customer needs management for Windows 2003 mobile based Smart phones that will be running business application, this particular base application has custom interface for different groups and therefore needs software distribution to deploy changes to this interface.

The users are often computer illiterate and are spread around the country so reliability and recovery has to be easy and is more important than the added security other products have over the DMFP.

Devices:

Initial devices will be HTC PH10C (Alpine) running Windows CE 4.21 second edition, Pocket PC format with a build in GSM/GPRS customized and branded by a Mobile operator.

Support and Problem recovery:

Windows 2003 mobile based devices are a complex combination of hardware and operating system were hard-reset is sometimes the only solution, the device has to be fully operational and available to the user so a customization to the Extended ROM necessary where the business application and the SMS client will be installed.

Most deployments will then also have to modify the Extended ROM.

Security:

The devices will communicate through a private GPRS APN supplied by the Mobile operator.
The SMS client will use SSL to communicate with the SMS server
The user will be forced to secure Windows CE with a pin number during hard reset.
The GSM SIM is secured with a PIN number.
In case of a lost or stolen device the SIM serial number will be blocked from usage by the Mobile operator.

Device Renaming:

By default all Windows 2003 mobile based devices are fixed with the name POCKET_PC, for proper identification and distinction in SMS administration the devices have to get a unique name by some automatic mechanism. Max name length is 15 characters (_, A-Z, 0-9)

There are few possible methods that can be used:

Smartphone’s hard coded IMEI number, First 8 identify the brand HTC supplies to HP, Dell, etc. next 7 can be used for identification, last 2 are checksum, this method was implemented.
Build in 32 character hex value GUID could be used as base
Static table using the GUID
ODBC connection to a central DB using the GUID

Knowledge needed:

For successful management of Windows mobile 2003 based devices using SMS the following knowledge is needed for the following technologies:

Windows CE

Windows CE platform builder (for OS updating and patching)

Visual Studio (because of Windows CE limited scripting and diagnostics)

SMS 2003

SQL

IIS

Certificate management

SMS 2003 Device Management Feature Pack DMFP functionality.

The feature pack supports Microsoft Pocket PC running Windows CD 3.0 and newer.

Core client functionality similar to SMS advanced and legacy clients:

Hardware Inventory

Software Inventory

File Collection

Software distribution

Additional functionality:

Device settings and management

Password policy management

Script engine

Components included in DMFP are:

Wince/Mobile pocket PC client

Password management client

Device Management Point

Admin console additions and wizards

Device discovery.

Devices can be discovered through the SMS desktop client (Heartbeat) and ActiveSync.

Client installation.

Manual installation via network or memory cards

Client push using SMS desktop client and ActiveSync.

Coldboot installation and recovery (depends on devices and providers)

Client Server communication.

HTTP/HTTPS SSL connection to a Device Management Point and Distribution Points, requires Certificate management

Port 80, can be changed to any port.

Unidirectional, the client connects to the Device Management Point on a polling schedule

The client never initiates WAN connections like GPRS or VPN, only used existing connections. (Changes in V4 where 3 levels can be choosen)

Certificate Management.

Can use Microsoft AD CA or any external provider like Versign, Thawte etc.

The DMFP client installation provides automatic Certificate installation.

Password policy management client.

Adds configurable settings like, forced power on password with number of rules and lockout and admin password to unlock again.

Policies include choices of PIN, strong, failed attempts and unattended timeout

Hardware Inventory

Similar to Desktop SMS hardware inventory

Hardware Inventory Extension

The Hardware Inventory can be extended to collect custom information like Registry branding values, this can be done by running a executable that will populate a special XML file on the device which will then be collected, the SMS_DEF.MOF file also needs to customized for this.

Software distribution.

Download only using BITS and checkpoint restart.

Connection aware 1MB and better is considered fast and anything less considered slow.

Remote control:

There is no support for remote control in the SMS DMFP but Microsoft provides one that could be implemented along, it does how ever not work well over GPRS and is only user initiated where the user has to contact the System name/IP address of the support personnel PC.

Policy generation.

The SMS DMFP provides number of predefined policy’s which technically are CAB files deployed using Software distribution or by manually running them during system build.

Build in configurable policies are:

ActiveSync and Exchange Server E-mail
Browser Favourites
Certificate Settings
GPRS Network settings
Password Policy
PPP Network Settings
Proxy settings
Registry Entry Settings
VPN Settings

Dependencies:

SMS 2003 server SP1

IIS

BITS

WebDAV

Name resolution like WINS or DNS with shortname capabilities.

SMS virtual testlab performance example.

Larus Milan Bulat — Mon, 08 Jan 2007 17:07:00 GMT

This might be intersting for anyone who does not have racks of servers available for testing or learning.

The VMWare's free Virtual server is an excellent tool to test and develop SMS / OSD / BDD solutions and I wanted to share with you some performance figures. Until now I had been using the Microsoft Virtual PC since it was part of the PSDN kit and then free for anyone but I wasn't always happy with the performance compared to VMWare.

The comparision favors VMWare in many ways but the performance is the main issue, what I have learnd is VPC does not run multihtreaded until you install the VPC utilities which is not available when running in WinPE and only gets installed at the last stage of a BDD master system setup, I've not tested Microsoft Virtual server which does not have this limitation but Microsoft plans however to fix this in the upcoming VPC 2007

Host PC:
Windows XP sp2 with latest hotfixes and antivirus.
1 Intel P4 630 3GHz
2GB RAM
VMWare Server 1.0.1 and VPC 2004sp1 installed but never running at the same
time.
1 HDD for host OS
1 HDD for Virtual Server files
1 HDD for Virtual Workstation

Virtual server instance:
Windows 2003 ent sp1
AD-PDC,DNS,DHCP,WINS
SQL 2000 ent sp4
SMS 2003 SP2
Original OSD using WIM 0.9 and WinPE 2004
2 virtual drives, one for BDD and images

Virtual workstation instance:
MasterXP: BDD build as simple as possible using SP2, no Office and no post
SP2 hotfixes or VM/VPC utilities

About the testing:
Host was rebooted before each test.
VMWare and VPC SMS server on same HDD but seperate partitions to prevent any
fragmentation.
Virtual workstations on the same HDD but virtual files deleted after each
step to prevent fragmentation from affecting the resaults.
WIM 0.9 and 1.0 comparsion planned but never got around doing that.

Test steps:
1. Boot from BDD lab.iso / SMS Capture CD dialog box
2. Press finish on OSD Image Capture Wizard / Shutdown
3. Power on using OSD image capture CD / Capture Complete
4. Power on using OSD image installation CD / Image install finished

Time each step takes:
1. VMWare=25min, VPC=84min
2. VMWare=20min, VPC=39min
3. VMWare=16min, VPC=31min
4. VMWare=5min, VPC=17min