Site Root

WMUG Exclusive - A day with Wally Mead covering ConfigMgr 2012 SP1 and Mobile Device Management

Rob Marshall - MVP — Fri, 21 Jun 2013 08:00:00 GMT

21st of June 2013 - Cardinal Place, London Victoria

9:00am to 5:30pm

See bottom of page to Register

Select Download to download a Calendar reminder

The Windows Management User Group welcomes Wally Mead, Senior Program Manager for the System Center 2012 Configuration Manager Product Group back to the UK for a day of System Center 2012 Configuration Manager Service Pack 1 and Mobile Device (inTune) presentations.

This year we have as before, a full day of activities focused on ConfigMgr, and we have several giveaways which we will raffle out during the day.

Wally Mead has been with Microsoft for 19 years, starting in the Microsoft training group where he got his first exposure to systems management with SMS 1.0. He's been in the Configuration Manager product group for the past 13 years, working on all versions of the SMS/Configuration Manager product. Currently he works with TAP customers beta testing Configuration Manager 2012, as well as developing hands-on lab materials for conferences and TechNet Virtual Hands-on labs.

If you are going to TechEd Europe you will see some of this content presented, but Wally intends to mix things up a little so both those that will attend TechEd Europe and those that are unable to make it will both benefit from attending this all day event

This years lunch break consists of the usual refreshments but we will also be making available an advanced driving simulator called iRacing, with a steering wheel and pedals on a wide screen TV for those that wish to have some fun driving a Formula 1 car around a world-famous circuit.

Giveaways on offer for the lucky winners of the raffle

An all expenses paid meal with the WMUG team and Wally Mead at a London eatery (subject to your availability!)
ConfigMgr 2012 books signed by Wally Mead
An opportunity to have your photo taken with Wally Mead
Other exciting giveaways are still being acquired and could consist of Windows-to-Go USB keys and other fun stuff

The winner gets to choose their prize and we will continue to draw names until everything has been given away!

So, without much further ado here is the schedule to wet your appetite and get you ready to book the day off and to click that register button. There are 100 seats available, and due to the location and content we expect these to fill up very quickly. Don't delay or you may be disappointed.

* Agenda subject to change

** Wally Mead may not have enough time to cover all these sessions, if this is the case the most popular will be selected and presented

See bottom of page to Register (use comments field to enter any special dietary requirements)

Select Download to download a Calendar reminder

Blog Post: Add Non-Microsoft licence information into Configuration Manager 2012

Peter Egerton — Fri, 24 May 2013 12:14:00 GMT

In order to get the most out of your Microsoft System Center 2012 investment you'll no doubt want to get the Asset Intelligence features of Configuration Manager (SCCM) working. You can add your Microsoft Volume licensing statement into SCCM but what if you want to add in non-Microsoft licences? Now I'm making an assumption here that you'll already have software inventory enabled on your clients as this is a pre-requisite. If so read on.

Firstly you'll need to run the SCCM 2012 console and browse to Assets and Compliance>Overview>Asset Intelligence>Inventoried Software.
Now in the main section of the window you should perform a search for the software you wish to add to your licence report.
Once you have found the matching software you should make a note of the Product Name, Vendor and version number - it is important that you copy this exactly.

You now need to create a csv file which looks like this. You must include all the header fields even if you don't intend to use them.

Name	Publisher	Version	Language	EffectiveQuantity	PONumber	ResellerName	DateOfPurchase	SupportPurchased	SupportExpirationDate	Comments
MindManager	Mindjet	2012	English	100	1234567		01/01/2013			Test Only

I have included an example attachment which can be found at the bottom of this post.
Mandatory fields which must have data entered are as follows:
Name, Publisher, Version, Language, EffectiveQuantity

If you would like to add multiple versions or multiple products you can simply add another line to your CSV file with the relevant product information, just remember it has to match exactly what is found in inventoried software.
Once you have created your CSV file and are happy with it, save it somewhere accessible by URL from your SCCM console.
Now back in SCCM, browse to Assets and Compliance>Overview>Asset Intelligence. Right click Asset Intelligence and select Import Software Licenses.
Click Next at the Import Software License Statement.
Now choose General Licence Statement (.csv file) and enter your URL. (The exclamation will disappear when you add a valid URL)
At the confirm the setting screen click Next. This will now import your licence information into the SCCM database.
If the import is successful you will see the Completion screen.
Now to ensure your import has worked you should browse to Monitoring>Overview>Reporting>Reports>Asset Intelligence.
Select or search for the 'License 15A - General license reconciliation' report. Right click the report and click Run.
Select your values by clicking the blue link and select your desired collection to report on.
Now click the View Report button to see the report. If everything was completed correctly you should see your product name now listed alongside the licensing information for it.

Here is the csv file you can use as a template, but due to blog restrictions I have had to upload it as an xls. Simply change the file extension to csv. ManualLicense.xls

Wiki Page: WMUG Event - Software Updates Overview with Robert Marshall MVP

Rob Marshall - MVP — Thu, 23 May 2013 19:57:00 GMT

The Windows Management User Group (WMUG) is proud to announce a virtual event for Software Updates Management hosted and presented by Robert Marshall MVP ConfigMgr

Thank you

Thank you for attending the event, the Power Point slide deck used for this session can be found here

Recording

The recording will be mastered shortly, and a link will be placed here

Overview

In this session Robert Marshall will cover the following aspects of Software Updates Management in ConfigMgr 2012

What is Software Updates Management
Infrastructure requirements for Software Update Management
Defining a Patching regime for your organisation (scheduling)
Software Updates - Patch classifications and severity
Using the Search facilities in the ConfigMgr Console to refine your selections
Software Update Groups
Deployment Packages
Automatic Deployment Rules
Software Updates Management Reporting
Deploying Software Updates
Understanding Supercedence and Expired Software Updates
Controlling Software Updates installation behavior
Software Updates Deployment Monitoring
Software Updates logging both Client-side and Server-Side
A tour of the Software Updates Windows Management Instrumentation namespace on the client
Basic troubleshooting steps for Software Updates
Extending Patch Management to handle non-Microsoft patches
Microsoft Forefront Endpoint Protection 2010 and Software Updates

Target Audience

This session is targeted to those that are new to Software Updates Management up to those that have been using it for a short time. Advanced Software Updates Management administrators and operators will already know most of this content but are welcome to join.

When

This event will take place on the 23rd of May 2013 at 19:30 BST (convert timezone here) and will last for one hour.

Agenda

19:30 - 19:32 Welcome

19:32 - 20:25 An overview of Software Updates Management

20:25 - 20:30 Questions and Answers

Where

This is a virtual meeting using the LiveMeeting client which you can download here

To attend this Event visit the following URL

Click here to add the Event to your Calendar

Presenter and Host bio:

Robert Marshall is an MVP in ConfigMgr and is a Windows Management founder and Community Leader and has been using Software Updates from design, implementation and operations since it was integrated into the product. Robert is active in the community as an MVP in ConfigMgr and brings his years of experience and grey beard to the User Group so as to to share all his knowledge with whoever wants it. Robert runs a non-Microsoft apprenticeship programme in the UK to grow budding ConfigMgr administrators. Robert is also Director of SMSMarshall Ltd, an exclusively ConfigMgr-only specialized Consultancy in the United Kingdom from which he provides consulting services for ConfigMgr 2012 for design, migration, implementation, break\Fix and bespoke highly-tailored Training.

File: Software Updates Overview with Robert Marshall MVP

Rob Marshall - MVP — Thu, 23 May 2013 19:55:00 GMT

Here are the Slide decks used for this Virtual Event

Software Updates Overview with Robert Marshall MVP

Rob Marshall - MVP — Thu, 23 May 2013 18:30:00 GMT

The Windows Management User Group (WMUG) is proud to announce a virtual event for Software Updates Management hosted and presented by Robert Marshall MVP ConfigMgr

Thank you

Thank you for attending the event, the Power Point slide deck used for this session can be found here

Recording

The recording will be mastered shortly, and a link will be placed here

Overview

In this session Robert Marshall will cover the following aspects of Software Updates Management in ConfigMgr 2012

What is Software Updates Management
Infrastructure requirements for Software Update Management
Defining a Patching regime for your organisation (scheduling)
Software Updates - Patch classifications and severity
Using the Search facilities in the ConfigMgr Console to refine your selections
Software Update Groups
Deployment Packages
Automatic Deployment Rules
Software Updates Management Reporting
Deploying Software Updates
Understanding Supercedence and Expired Software Updates
Controlling Software Updates installation behavior
Software Updates Deployment Monitoring
Software Updates logging both Client-side and Server-Side
A tour of the Software Updates Windows Management Instrumentation namespace on the client
Basic troubleshooting steps for Software Updates
Extending Patch Management to handle non-Microsoft patches
Microsoft Forefront Endpoint Protection 2010 and Software Updates

Target Audience

When

This event will take place on the 23rd of May 2013 at 19:30 BST (convert timezone here) and will last for one hour.

Agenda

19:30 - 19:32 Welcome

19:32 - 20:25 An overview of Software Updates Management

20:25 - 20:30 Questions and Answers

Where

This is a virtual meeting using the LiveMeeting client which you can download here

To attend this Event visit the following URL

Click here to add the Event to your Calendar

Presenter and Host bio:

WMUG Events Calendar

Rob Marshall - MVP — Thu, 23 May 2013 13:52:00 GMT

WMUG Events Calendar

Blog Post: Best of MMS UK – Tuesday 21st of May 2013

Rob Marshall - MVP — Mon, 20 May 2013 18:44:00 GMT

The Best of MMS UK registration is closed now and there will be an epic amount of folk there as well as partners. I’ll be attending so if you see me and want to say hi just pull me up, always happy to chat and meet.

http://blogs.technet.com/b/uktechnet/archive/2013/05/10/reminder-the-best-of-mms-uk-2013.aspx

Blog Post: Administering and Deploying System Center 2012 Configuration Manager – 70-243 exam

Peter Egerton — Mon, 20 May 2013 16:48:00 GMT

Having passed this exam a number of different Microsoft exams myself, I thought some people may find it useful to get some feedback and guidance from someone who’s been there and done it. Now obviously I’m not going to give away any answers or suggest what the questions may include due to the Non-Disclosure Agreement (NDA) that goes with taking Microsoft exams. What I can do is point you in the right direction regarding what you need to revise and show you the content that is out there and available to help you get through this exam.

Detail of the “Administering and Deploying System Center 2012 Configuration Manager” 70-243 exam can be found on the Microsoft website here:

https://www.microsoft.com/learning/en/us/exam.aspx?id=70-243&locale=en-us#fbid=zW9BesVG5EG

I don’t personally believe there is a hard or an easy exam, it’s simply about what you do or don’t know. When talking about various exams I’ve been told by people in the past things like:

“It’s an easy one, I finished it in about half an hour”
or
”I found that tricky, those simulations were impossible”

For me it really does depend on the individual, if you haven’t done something before then you’re not going to know it well. Different people know and remember different things in different ways.

Before you start

The first thing I would say, and this may sound obvious, is to check through the exam web page. So often do people just look up the exam code, skim the skills measured and go book the exam. Take a few minutes to read through the full page to make sure the exam is what you think it is and use it to set out what preparation you need to do in order to pass it.

The Overview section gives you an ‘Audience Profile’. Take a read through it and just satisfy yourself that have the accompanying background knowledge to be able to pass this exam. For 70-243 you need to know a bit about SQL, Powershell, mobile device management and application configuration. If you’re wondering what Powershell is then maybe there’s your starting point. It’s not a Powershell exam but you should at least be familiar with it, know what cmdlets are and know a few common cmdlets that are used with System Center 2012 Configuration Manager. The same applies to SQL, can you perform a basic query and are you familiar with the various SQL components that are used with Configuration Manager?
Does your job title fit with the kind of jobs that are listed in the audience profile? This is obviously not a hard and fast rule but you should be able to fit yourself in amongst some of those titles in at least your job responsibilities.

What to revise?

The real important part of the exam webpage is the ‘Skills Measured’ section. This in theory is what can be covered within the questions you are going to be asked and each section has a relevant weighting. That said, each subsection has “This objective may include but is not limited to” at the start of the sentence so don’t be startled if something else is in there. But generally speaking if you are comfortable with what’s in the skills required then there shouldn’t be any surprises. In the 70-243 exam, each section has the same weighting at 10-15% so in theory you need to know each area equally.
The sections are as follows and I have included some links to suggested study material:

Design and Plan System Center Configuration Manager Infrastructure
Why not check out the Infrastructure Planning and Design guides for this - http://technet.microsoft.com/en-us/solutionaccelerators/ee395430.aspx
You should also be familiar with any new features of the product - http://blogs.technet.com/b/server-cloud/archive/2012/03/08/the-biggest-changes-in-hierarchy-design-in-configuration-manager-2012.aspx

Manage Operating System Deployment (OSD)
Be familiar with OSD processes and practices - http://technet.microsoft.com/en-us/library/gg682108.aspx

Deploy Applications and Software Updates
Know the differences between an application and a package and the limitations of each.
Check out the Microsoft Virtual Academy - http://technet.microsoft.com/en-us/video/video/microsoft-virtual-academy-module-3-system-center-configuration-manager-2012-overview-and-infrastructure-application-management-part-1 and http://technet.microsoft.com/en-us/video/video/microsoft-virtual-academy-module-4-system-center-configuration-manager-2012-overview-and-infrastructure-application-management-part-2
Look at App-V deployments - http://blogs.technet.com/b/keithmayer/archive/2013/01/04/managing-app-v-5-virtual-applications-with-system-center-2012-configuration-manager-service-pack-1.aspx
Know about software updates - http://wmug.co.uk/wmug/b/r0b/archive/2013/05/13/wmug-event-software-updates-overview-with-robert-marshall-mvp.aspx

Manage Compliance Settings
It’s all about Configuration items and Configuration Baselines - http://technet.microsoft.com/en-us/library/gg682139.aspx and http://technet.microsoft.com/en-us/library/gg712268.aspx

Manage Sites
Understand how sites work together, how communication flows between them and the limitations - http://technet.microsoft.com/en-us/library/hh427336.aspx
Know how to configure role based security - http://blogs.technet.com/b/configmgrteam/archive/2011/09/23/introducing-role-based-administration-in-system-center-2012-configuration-manager.aspx
Know how to monitor your site health - http://technet.microsoft.com/en-us/library/hh427342.aspx

Manage Clients
Understand the different methods of deploying clients and the different types of clients - http://technet.microsoft.com/en-us/library/gg699391.aspx

Manage inventory
Hardware Inventory - http://technet.microsoft.com/en-us/library/gg699374.aspx
Software Inventory - http://technet.microsoft.com/en-us/library/gg682049.aspx

Manage Reports and Queries
Know some basic WQL and select statements for console queries - http://technet.microsoft.com/en-us/library/gg712323.aspx
Know the basics of SQL reporting services and how to create and modify reports - http://technet.microsoft.com/en-us/library/gg682105.aspx

Outside of those web links you can often find videos which will show you how to perform certain tasks or explain how certain things work. The Microsoft Virtual Academy is a brilliant place for this. You can also find demonstration videos on other well known video websites.

If you want specifically tailored training then you should look to the “Preparation Materials” section of the exam webpage. This identified the Microsoft specific training courses that will cover off the objectives outlined for the exam. For 70-243 (at the moment) there is only classroom training available. As an alternative to this you can purchase video training from vendors such as CBT Nuggets or TrainSignal.

Booking the exam

Microsoft use Prometric as their testing partner, if you’ve taken Microsoft exams before then you’ll know the procedure. If not then it’s a simple process, just follow the instructions on the Prometric website, choose your exam and pay for it. Don’t forget to look out for Microsoft promotions such as Second Shot which Microsoft run from time to time. Once you’ve passed the exam you’ll receive and email from Microsoft with a welcome pack and it’s at that point you’ll get assigned a Microsoft Certified Professional (MCP) ID.

That should just about cover it. Don’t forget to keep reading the WMUG blogs, forums, follow the twitter feed and sign up as a member as we have some of the most knowledgeable System Center experts around including Microsoft MVP’s.
If you have any specific questions – post a comment!

Peter

Page: About Us

Anonymous — Sun, 19 May 2013 18:13:00 GMT

Forum Post: What is your primary System Center product?

Peter Egerton — Fri, 17 May 2013 10:33:00 GMT

We want to know what System Center product you spend most of your time working with. Let us know using the attached poll.

Thanks!

[Poll]

Blog Post: Configuration Manager 2012 SP1 Management Point Installation Error 1603

Peter Egerton — Fri, 17 May 2013 10:13:00 GMT

I fell foul of this problem this week where I had been installing a System Center Configuration Manager 2012 SP1 site server. This was a new build Windows Server 2012 but as I began the installation a handy error message alerted me to the existence of an SCCM client. It became apparent that the existing Configuration Manager 2007 implementation was set to deploy clients to any discovered device automatically. I then went about removing the client, the command to use for this is as follows:

%WINDIR%\system32\ccmsetup\ccmsetup.exe /uninstall

See here for more details.

This then allowed me to re-run the installation without issue. Except, once the installation completed and I began configuration I soon realised that the installation of the management point had actually failed. After checking the MPMSI.log I could see the following error throughout the file:

Failed to compile ‘D:\Program Files\SMS_CCM\CcmExec_Global.mof’ (Phase: 3, Object: 5, Lines: 76 – 83, Error: 80041002)
Failed to compile ‘D:\Program Files\SMS_CCM\PolicyDefaults.mof’ (Phase: 3, Object: 4, Lines: 49 – 57, Error: 80041002)
Failed to compile ‘D:\Program Files\SMS_CCM\DataTransferService.mof’ (Phase: 3, Object: 5, Lines: 318 – 323, Error: 80041002)
Failed to compile ‘D:\Program Files\SMS_CCM\CcmExec_MP.mof’ (Phase: 3, Object: 1, Lines: 31 – 36, Error: 80041002)
mp.msi exited with return code: 1603

I attempted to remove and re-install the management point a number of times but the results were the same. After some searching around the web I found that the error was related to the previous existence of a Configuration Manager client on the server. It seems that the client uninstall still leaves some traces on the machine. After reading various posts I found that some people had success with the SMS tool CCMCLEAN but this didn't work for me. I also found a number of posts that suggested re-building the WMI repository but this seemed a little extreme. In the end I ran the following powershell command to remove any trace of 'CCM' from WMI. Make sure you note the space after FROM.

Get-WMIObject -namespace “root” -query “SELECT * FROM __Namespace where name = ‘ccm’” | remove-wmiobject

I then re-installed the management point and watched MPMSI.log with CMTrace, the installation completed. I won't fall foul of that one again!

Blog Post: Unsticking Clients from unavailable Distribution Points

Rob Marshall - MVP — Thu, 16 May 2013 13:45:00 GMT

I was at a customer site recently and they were simulating a data centre failure as part of their Disaster Recovery plan. They replicate the Site server as a VM across to another data centre in real-time and fail over to it when the main Site server is taken offline, and during the testing they came across a problem with Clients sticking to Distribution Points that were made unavailable as part of the Disaster Recovery exercise. In reality the Distribution Points should also be replicated and switched over too, but this wasn’t done. The problem was that the Clients would not install anything that had already been deployed to them but had not yet been installed, the deployments were on the Client but the Applications content had not yet been downloaded.

This Distribution Point stickiness is a well-known feature of ConfigMgr going back a long time, the Client will select a Distribution Point containing the content it requires from the provided list of Distribution Points and try to contact it, at which point the Client will realise the Distribution Point is down, note it as a recoverable error as opposed to an unrecoverable error and it will then attempt to retry the Distribution Point for up to 8 hours before moving on to the next Distribution Point in the list. This is to give the administrators a chance to recover the Distribution Point. If the next Distribution Point is down, there’s another long wait until a Distribution Point that is available is found and downloads begin. This Client had 3 Distribution Points and unfortunately the two failed Distribution Points where at the top of the list resulting in a 16 hour wait before content for existing Deployments could be downloaded and the applications installed. Obviously, this induced a lengthy wait time before the Clients begin downloading content correctly, and the customer wanted to get around this quickly.

There are a couple of workarounds for this:

Boundary change on the Site server if it is still available
Roberts special magic!

If you remove the failed Distribution Point from a boundary group, this will result in the Client ignoring the unavailable Distribution Point and going to a Distribution Point that is still servicing the Clients boundaries. A very simple solution, it requires a change in the ConfigMgr Console to remove the Distribution Point from the Boundary Group, or on specific boundaries if you have configured the Site that way, and adding the boundary to the Site system hosting the available Distribution Point. Once DR is complete you’d have to change all this back to how it was before the outage took place. This solution requires several “moves” so to speak, it’s not much effort and it works but I like solutions that are simple and contain fewer moves.

Here’s an example of a Boundary group where you would remove the unavailable Distribution Point:

Once the Clients talk to the Management Point again they will update the list of Distribution Points that service the Clients boundary, it’ll ignore the Distribution Point no longer servicing them and select a new Distribution Point to retrieve the content from. The Client will check policy based on the Client Settings (Client Policy) applied to the Client, with the default being every 60 minutes. Client Settings in ConfigMgr 2012 can be defined on a Collection basis rather than being a site-wide setting as it was in ConfigMgr 2007, so depending on how you have set this up the Client will do a policy update based on the default value mentioned or any custom settings that you have applied.

In theory you could also change the existing Site system containing the unavailable Distribution Point from fast connection to slow connection so that the available Distribution Point servicing the Clients boundaries takes precedence, I haven’t tested this solution but it also seems very viable. This again is simple, and has far fewer moves to complete the task. I’ll test this at some point to see if the Client behaves itself and that this is a workable solution. It should do and has fewer moves required to achieve the end result but assumes the Primary is available for the administrator to make the changes.

Changing boundaries assumes the Primary is still available, the SMS Provider is accessible and the Console can establish a session to actually make the changes. If the Primary was unavailable and some Distribution Points that could service the Client for content are online, the Client would hang around for 8hrs+ per unavailable Distribution Point until it found the available Distribution Point and as an administrator nothing could be done until the Primary is back in operation at which point you can make changes, but I’d hazard a guess if the Primary is back no doubt the recovery of Distribution Points would also be not far behind it. In this scenario where the Primary has not returned to operational status, to accelerate things you will need a different way to motivate the Client into moving onto the next Distribution Point in its list until it has found an available Distribution Point, this is where the Magic comes into play!

Well it’s not really magic, I just wanted to keep you reading and get you down to here where the fun really begins!

If the Site is unavailable or you have a streak of derring-do in you and you’d like to leave the Site servers configuration intact you’ll have to think outside the box, and here’s the solution I came up with, it’s a pretty simple solution, you make a change in one place outside of ConfigMgr and in under an hour the Clients will select the online Distribution Point and proceed to download content. That kind of qualifies as magic!

How we achieve this is by changing the A record for the unavailable Distribution Point in DNS so that it points at a member server that is available. This tricks the Client into recognising the Distribution Point as being in an unrecoverable state, and thus, it will move onto the next Distribution Point in the list. Brilliant.

Below, I’ve produced some screenshots to assist with explaining the steps involved to achieve this result, but the shots are not taken from an environment where the problem is being reproduced fully. Instead, I’ve just taken shots of the relevant dialogues and shots of actual real logs that came from the client (their details stripped and replaced with some names of servers in my lab), so don’t worry if in the shots you don’t see Distribution Points listed and such stuff. Anyway if you are expecting a hand-holding through this solution then I think you’d better not continue, you should be familiar with all the moving parts involved and be able to understand this fully end-to-end.

Let’s go over what will happen:

Administrator changes Distribution Points A record in DNS to point at a different IP address
DNS replication takes place if there are multiple DNS servers in the environment
The Clients local DNS Cache eventually expires the A record and retrieves an updated one from its assigned DNS server
The ConfigMgr Client retries the Distribution Point and returns an unrecoverable error instead of a recoverable error, no further waiting will occur
The ConfigMgr Client immediately moves onto the next Distribution and repeats the same process if the Distribution Point is unavailable or it downloads the required content

Let’s go over how the Client handles DNS, the DNS Cache on every OS is managed automatically for us, and each entry in the local DNS Cache has a Time To Live and once the TTL has expired the A record is removed from the DNS cache on the Client and refreshed from the assigned DNS server. This works in our favour but also introduces some latency into the solution.

Here’s a shot of my DNS servers Zone properties showing the TTL and as you can see I have retained the MS defaults for the TTL which is 60 minutes, 3,600 seconds:

When my Client first looks up this Distribution Points A record, it retrieves this A record and puts it in the local DNS Cache, it counts down the TTL until it has expired.

Here’s a shot of a record in the local DNS Cache and as you can see it has 1,197 seconds left before the A record is flushed from the local DNS Cache and replaced with an updated A record from the assigned DNS server:

I flushed my DNS cache then pinged the FQDN to populate the local DNS Cache for this screenshot, you achieve this using IPCONFIG\FLUSHDNS and you view the local DNS Cache using IPCONFIG/DISPLAYDNS.

Notice the Time to Live (TTL) is displayed in seconds and repeated rendering using IPCONFIG/DISPLAYDNS will show the value decrementing. When the TTL has expired contact is made to the assigned DNS server(s) and a refreshed A record will be retrieved.

If you wanted you could expedite this process by manually flushing the local DNS Cache but this isn’t very practical to perform manually on many Clients. To flush the local DNS Cache use IPCONFIG/FLUSHDNS, the Clients DNS Cache will be flushed away and future name lookups will retrieve the latest A record from the assigned DNS server.

In theory you could create a Package\Program containing no content just a command line to flush the local DNS Cache then deploy it to your Clients so that they flush the DNS cache quickly, assuming the Primary is available, but it requires a lot of back-end fiddling, it requires new objects in ConfigMgr, a new deployment to all affected Clients. It is a viable way to speed things up if you needed to do so, but the costs in administrative time, the assumption the Primary is available and the latency in Clients picking up new Policy may make this an excessive process and when the Deployment fires on the Client it may coincide with the TTL expiring anyway. If your Clients checked for new Policy every 15 minutes this is doable I guess.

Here’s a shot of the A record for my Site server in the active DNS Zone for my domain, the A record is not from a Distribution Point but as I said these shots are there simply to point out the areas to head too:

You will see that the IP Address is pointing at the actual IP address of the unavailable Distribution Point.

It’s pretty obvious where you’d make the change of IP address, but just to ram it home here’s another screenshot:

The IP address you use must represent a server that is online otherwise you’ll remain pinned to the unavailable Distribution Point.

Once you have changed the IP address for the unavailable Distribution Point the A record will be replicated to the other DNS servers in your environment. If you have a lot of DNS servers this could also introduce latency into the solution while you wait for the A record to change on the DNS server the client is using for name resolution. You could in practice determine which DNS server or servers the Clients are using and make the change right there, then let it replicate from there out to the other DNS servers to speed things up.

After the TTL has expired for the A record in the Clients local DNS Cache, the A record is refreshed and the changed IP will be shown if you use IPCONFIG/DISPLAYDNS.

Ok now that’s the infrastructure changes made, now it is entirely on the ConfigMgr Client to realise that the Distribution Point is in an unrecoverable state.

Once the A record has been updated, what will happen is the Client will try to contact the unavailable Distribution Point but this time it will get a response from the member server using the specified IP address. And, when the Client attempts to connect to this IP address there will be a conflict because the name of the server isn’t correct, this induces an unauthorised error back to the Client which tricks it into thinking this is an unrecoverable error.

Here’s a shot of the list of Distribution Points containing the Content the Client wants, notice we have three Distribution Points listed, two of which, 01 and 02 are down\unavailable\off the network (in reality they were just VM’s switched off for this simulated DR exercise), 03 is our available Distribution Point:

Here’s a shot of the Client seeing that the Distribution Point returned an unauthorised error which induces the unrecoverable error we need to unpin from that Distribution Point:

At this point the magic has worked, we have forced the Client to note the Distribution Point as being in an unrecoverable state due to the unauthorised error being returned!

Here’s a shot of the Client immediately going to the next Distribution Point in the list. This Distribution Point is also down. Rinse and repeat as they say:

And here’s a shot of the Client moving onto the third Distribution Point in the list, this one is online, notice the lack of errors, this is an available Distribution Point and content transfer will begin immediately thereafter:

So, by making a change to just the A record for the unavailable Distribution Points we have unstuck the Client from the failed Distribution Points and forced it to move onto the available Distribution Point. We have effectively controlled default behaviour, behaviour we had no control over before without making changes on the Site server with regards to Boundary\Boundary Groups and Site systems containing Distribution Point roles that service those boundaries.

This solution allows us to step in and take control even if the Primary is offline and we are unable to make any changes to boundaries. If this was the case, without the magic above we’d have to recover the Primary to make the changes to the boundaries.

I guess I should sign off with the usual disclaimers that this is Magic and sometimes Magic can burn, so always go through this in a lab, in dev, pre-prod, whatever you have, and, if you have 10’s of thousands of Clients involved, there will be a lot of traffic generated towards the replacement IP address entered into the A record for the unavailable Distribution Points. If the Primary is still online it makes sense to enter it’s IP address into the unavailable Distribution Points A record, so as to not interfere with production services on the member server you choose for the IP address needed above.

I should also thanks Jon Rumens for letting me tijnker with his DEV environment to produce this solution, and also I’d like to call out this guy, Carlitog, who posted on the System Center 2012 Configuration Manager forums a solution for handling a boundary change if the Primary is down but you use remote SQL and have another SMS Provider available to leverage use to make changes via PowerShell. Check out the thread here.

Hope this article is helpful for you, or insightful et al.

Blog Post: Configuration Manager 2012 SP1 Pull Distribution Points

Peter Egerton — Tue, 14 May 2013 20:44:00 GMT

One of the great features of Microsoft System Center Configuration Manager 2012 SP1 is the ‘Pull distribution point’. This allows you to specify certain distribution points (DP’s) in your Configuration Manager environment to pull content from others. You can specify multiple source DP’s for your pull DP which will give you a little more control over your traffic and where it goes.

There are lots of uses for this facility but probably the most typical use may be if you have slow links to your primary site DP but a better link to an alternative DP.

This example shows that…

In this situation the link between DP1 and DP1 is better than the link between SCCM1 (Primary Site Server & DP) and DP2. Therefore with pull DP’s you can daisy chain off another DP like so…

So DP2 will only get content distributed from DP1 therefore easing the load on the 4Mb link between SCCM1 and DP1.

It might sound a little obvious but you need to have multiple DP’s in your environment before you can do this and you can’t do it on a Primary site server DP, the required tab simply doesn’t show.

How do I do it?

Don’t forget this is for Configuration Manager 2012 SP1 only, it won’t work in 2012 RTM. The version numbers are as follows:

Configuration Manager 2012 RTM – Version 5.7711.0000
Configuration Manager 2012 SP1 – Version 5.00.7804.1000

If you want find out how to get your build number, see this technet link.

So, in your Configuration Manager 2012 SP1 console browse to

Administration>Overview>Distribution Points.

Go to properties of the DP you would like to become a Pull DP and you will see a tab named “Pull Distribution Point” as below.

Now you can simply tick the box to “Enable pulling content from other distribution points” and click the Add button to select the source DP(s) of your choice. Simple really.

In my lab setup SCCMLAB is my primary site server and DP and will become my source DP, SCCMDMZ is just a DP and is going to be my PullDP.

You can also see this in the distmgr.log on the primary site server

DP settings have been updated to SCCMDMZ.lab.com. $$<SMS_DISTRIBUTION_MANAGER><04-18-2013 10:47:24.938-60><thread=1448 (0x5A8)>

Upgrading PullDP with ID 16777218. Thread 0xd9c. Used 1 threads out of 5. $$<SMS_DISTRIBUTION_MANAGER><04-18-2013 10:47:43.304-60><thread=352 (0x160)>

~DPID 16777218 - NAL Path ["Display=\\SCCMDMZ.lab.com\"]MSWNET:["SMS_SITE=LAB"]\\SCCMDMZ.lab.com\ , ServerName = SCCMDMZ.LAB.COM, DPDrive = , IsMulticast = 0, PXE = 0, RemoveWDS = 0 $$<SMS_DISTRIBUTION_MANAGER><04-18-2013 10:47:43.307-60><thread=3484 (0xD9C)>

ConfigurePullDP $$<SMS_DISTRIBUTION_MANAGER><04-18-2013 10:47:43.308-60><thread=3484 (0xD9C)>

~NAL Path ["Display=\\SCCMDMZ.lab.com\"]MSWNET:["SMS_SITE=LAB"]\\SCCMDMZ.lab.com\ is a Pull DP $$<SMS_DISTRIBUTION_MANAGER><04-18-2013 10:47:43.328-60><thread=3484 (0xD9C)>

How does this work?

I’m not going to go into the fine detail but you should know what to expect and how to handle pull DP’s so you might wonder how this actually works.

Will it automatically pull content?
Can you schedule it?
What’s to stop you distributing content to your Pull DP from your console?

Firstly, nothing changes in the way you do anything in the console. Going back to my example, if you distribute content to DP1 it won’t automatically pull and it won’t make it’s way over on a schedule to DP2. You still need to distribute the content to DP2 as you would prior to having a pull DP. You just need to remember that if the content isn’t on DP1 (source DP) then it will never get to DP2 (pull DP).

In the console you’ll see it like this:

The content will still show as “In Progress” as it hasn’t been deployed to my source DP. The full message shown in the description field is as follows:

So you can see that it is looking for the content on it’s source DP, but I haven’t yet deployed it there. Now once I deploy the content to my source DP we should see the “In Progress” change to “Success”. You can either wait for the retry to kick in or redistribute the content to your pull DP.

The content begins to deploy…

and completes…

That just about covers everything you should need to know to get started with Pull Distribution Points in Microsoft Configuration Manager 2012 SP1.

Let me know if you have any thoughts questions etc.

Blog: Peter Egerton

Peter Egerton — Tue, 14 May 2013 20:30:00 GMT

Blog Post: WMUG Event - Software Updates Overview with Robert Marshall MVP

Rob Marshall - MVP — Mon, 13 May 2013 08:02:00 GMT

I’m running a session on Software Updates Management on the 23rd of May between 19:30 to 20:30 using LiveMeeting.

This is an online event that does not require an invitation, just turn up on the scheduled date and time.

Here’s the link the Events page on the Windows Management User Group website for more information.

See you there!

File: WMUG Event - Software Updates Overview with Robert Marshall MVP

Rob Marshall - MVP — Mon, 13 May 2013 07:49:00 GMT

WMUG Event - Software Updates Overview with Robert Marshall MVP Calendar File

Wiki Page: WMUG Event – Satisnet/Secunia – 10th April 2013 – Virtual

Rob Marshall - MVP — Tue, 07 May 2013 08:49:00 GMT

WMUG is proud to announce a virtual meeting with Satisnet/Secunia, presented by John McCann and Morten Stengaard and hosted by Raphael Perez

Overview:
Secunia CSI provides highly detailed software inventory including both programs and plug-ins. This inventory is in turn mapped to security intelligence related to the individual programs and plug-ins as well as details about vendor supplied security updates. The software can then automatically repackage these patches and push them to SCCM, allowing you to control, manage, and monitor the deployment using SCCM. The Secunia CSI can further conduct scans of desktop and server systems to ensure that the updates are applied correctly and that all systems are fully compliant.
- Secunia have the largest 3rd party application coverage of all patching vendors as they leverage their award winning security research team, 300 applications covered
- Secunia will add any specific vendor applications if required, starting by their research team monitoring said app for any vulnerabilities and in parallel creating a signature to detect the application within an SLA of 2 working days
- They utilise the software Inventory Agent within SCCM to asset scan, so uses existing infrastructure
- Results are fed direct into SCCM console, so are presented in your existing SCCM GUI, no retraining required

About Satisnet Ltd:
Founded in 2004, Satisnet Ltd is a leading IT Security Integrator dedicated to providing the highest level of customer care and technical support.

Satisnet have developed high level partnerships with a number of industry leading IT Security vendors including Secunia, IBM, Palo Alto Networks, Websense, AirWatch, VMware and Tenable. Together with our clients, we establish the most appropriate products and services to suit that particular organisations’ requirements, which would be dependent on factors such as industry, budget and compliance standards. We have a dedicated in-house technical team with the skills and expertise to fully support our products and services.

During this time our business has grown and we have established a strong professional reputation across a multitude of market sectors from Local Government, FTSE 250 to Financial and Charity organisations, with over 800 customers across Europe.

Find out more at http://www.satisnet.co.uk/

About Secunia:
Secunia is recognised industry-wide as a pioneer and global player within the IT security ecosystem, in the niche of Vulnerability Management. Their award-winning portfolio equips corporate and private customers worldwide with Vulnerability Intelligence, Vulnerability Assessment, and automated Patch Management tools to manage and control vulnerabilities across their networks and endpoints. A strong strategic vision of becoming number one is, and always has been, a founding pillar of Secunia. They deliver best-in-class solutions that have less superficial gift wrapping and instead contain true value. All Vulnerability Management products in Secunia’s portfolio provide proven endpoint protection against vulnerabilities, due to their special combination of unique application scanning, unrivalled expertise, and impeccable customer service. All of this is achieved by the dedicated efforts of the industry-renowned Secunia Research Team and enhanced by Secunia’s focused sales and support functions.

Find out more at http://www.secunia.com/

Video

(Please visit the site to view this video)

Who
Presenter bio:
John McCann, Director at Security Integrator, Satisnet, has been involved with IT for the last 30 years. He has worked in many environments ranging from a leading Defence company, through to Unisys, where he specialised in parallel processing solutions. For the last 20 years John has focused on working within the Information security industry, working for security vendors to include security startups , covering the ever evolving security challenges. In 2004 he founded Satisnet, a security integrator aimed at giving independent advice and on promoting best of breed technologies, while ensuring they operate and interwork with a customer’s existing infrastructure. Satisnet has some 800+ customers across Europe and has unrivalled expertise in implementing log management and SIEM for security and operational intelligence.

Morten Stengaard, is responsible for Secunia’s product management and QA function, defining Secunia’s product roadmap and ensuring that it is both commercially- and market-driven. In addition to this, he oversees Secunia’s Customer Support team who are responsible for delivering outstanding customer support. Prior to joining Secunia, Morten worked as Product Manager for the security software company BullGuard Ltd and Business Development Manager for the investment company Kukula Capital. He also co-founded a market analysis consultancy firm. Morten holds a B.Sc. in International Business (IB) and an M.Sc. in Finance & Strategic Management (FSM), both from Copenhagen Business School (CBS).

Host bio:
Raphael Perez is a Microsoft System Center Configuration Manager MVP based in UK, he specialises in System Center Configuration Manager (including OS Deployment) and other System Center products (Operations Manager, Service Manager, etc.) and is a WMUG community leader attending the physical meetings and engaging with the community across forums, twitter, LinkedIn and his blog. He is RFL Systems‘ owner, a System Center specialized consultant and training services within the United Kingdom.

Blog Post: Using the Hydration Kit for ConfigMgr 2012 SP1 in your own test domain.

Larus Milan Bulat — Thu, 25 Apr 2013 08:52:00 GMT

The Hydration kit is a fantastic way of saving time when building your own test lab, but as I prefer to use my own lab domain I needed to make few changes.

Hydration Kit for ConfigMgr 2012 SP1 can be downloaded from here: http://www.deploymentresearch.com/Research/tabid/62/EntryId/82/The-Hydration-Kit-for-ConfigMgr-2012-SP1-with-Windows-Server-2012-SQL-Server-2012-is-available-for-download.aspx

List of changes that need to be made:

Server name, Domain, OU, password and IP in this file:
- Change “C:\HydrationCM2012SP1\ISO\Content\Deploy\Control\CustomSettings_CM01.ini”
CM2012 Install, cdkey and site paths here:
- Change “C:\HydrationCM2012SP1\ISO\Content\Deploy\Applications\Install - ConfigMgr 2012\ ConfigMgr2012Unattend.ini”
SQL admin in the SQL config file:
- Change “C:\HydrationCM2012SP1\DS\Applications\Install - SQL Server 2012\ConfigurationFileCM2012.ini”, traced in the log file “C:\Program Files\Microsoft SQL Server\110\Setup Bootstrap\Log”
DomainAutoLogon, Typo I assume that will only be discovered when using different accounts:
- Change from "ADMINPASSWORD" to “DomainAdminPassword” in “C:\HydrationCM2012SP1\DS\Applications\Configure - Set Administrator Autologon in Domain\Configure-SetAdministratorAutologoninDomain.w s f”
“Set WindowsSource” Task Sequence step has a fixed path to the Operating System.
- Edit the path if you need to import your own.

User: alex.cop

alex.cop — Thu, 25 Apr 2013 07:22:00 GMT

Blog Post: Tech.Days Online UK Starts Tomorrow!

David Allen MVP — Tue, 23 Apr 2013 12:51:00 GMT

So, Tech.Days UK starts tomorrow and runs through until the end of Friday, and it is all available online. Take a look at the session schedule here, https://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032543696&Culture=en-GB&community=0, and register if you want to attend any of the sessions.

And, if you want to hear me present, I am presenting on Friday morning, "Appy Monitoring with System Center 2012". :-)

Enjoy!!

David