.:: (MVP) Raphael ::.

SCCM 2007 HealthCheck Toolkit goes PowerShell and Free

Raphael — Tue, 16 Apr 2013 13:33:54 GMT

The SCCM 2007 HealthCheck Toolkit was initially developed by dotNetwork. dotNetwork was the brand used by Raphael Perez, MVP in Enterprise Client Management, to perform consultancy and training. During 2012, dotNetwork was taken down and re-branded to RFL Systems Ltd and since them, we decided to stop selling the SCCM 2007 HealthCheck Toolkit and re-develop it.

The initial development was done using C# and Visual Studio, however, it was very difficult to keep it up to date and we decided to do it using Windows PowerShell.

Today, we're proud to announce the tool is available for free and can be downloaded from its own page here.

But, it won't stop there, we're also working on a SCCM 2012 version as well as always expanding and enhancing its functionality.

If you have any queries or comments, please, do so here

PS. How-to videos and documentation will be available soon.

3rd Party patch management - Part 10

Raphael — Tue, 09 Apr 2013 09:55:02 GMT

Hi All,

today is the last part of the secunia csi integration

after the installation, open the SCCM console as administrator

navigate to software library (note that there is a new node called Secunia)

expand the node and click configure and enter your credentials

if you havent configured the wsus, it is time (see the screenshots) and refer to Part 4 (http://wmug.co.uk/wmug/b/dotraphael/archive/2013/01/24/3rd-party-patch-management-part-4.aspx) on how to import/export the certificate

After the configuration, it is time to deploy patches. Select the node patches

select the software update you want to deploy and click Create update package

follow the wizard (in this case i left all default settings) and at the end, click ok for the package successfully created

after this, now it is time to sync the software update. If you don't do it, you'll not see the new product (see bellow screenshots before and after sync)

once the sync is done (you will see this on the logs), you have the new software into the all software updates and will be able to manage the same way.

3rd Party patch management - Part 9

Raphael — Mon, 08 Apr 2013 09:06:33 GMT

Hi all,

today we'll set up the CSI SCCM Plugin. To do this, you need to download it from http://secunia.com/vulnerability_scanning/corporate/sccm_plugin/

Once you have downloaded, execute it (I'm doing it on the SCCM Server itself). On the Welcome screen, click Next

Choose where you want to install and click Next

Select the location of the SCCM console. (it should have already been populated with the right path). Click Next

Accept the License Agreement and click Install

Once completed, click Finish

WMUG Event – Satisnet/Secunia – 10th April 2013 – Virtual

Raphael — Tue, 02 Apr 2013 09:00:53 GMT

WMUG is proud to announce a virtual meeting with Satisnet/Secunia, presented by John McCann and Morten Stengaard and hosted by Raphael Perez

Overview:
Secunia CSI provides highly detailed software inventory including both programs and plug-ins. This inventory is in turn mapped to security intelligence related to the individual programs and plug-ins as well as details about vendor supplied security updates. The software can then automatically repackage these patches and push them to SCCM, allowing you to control, manage, and monitor the deployment using SCCM. The Secunia CSI can further conduct scans of desktop and server systems to ensure that the updates are applied correctly and that all systems are fully compliant.
- Secunia have the largest 3rd party application coverage of all patching vendors as they leverage their award winning security research team, 300 applications covered
- Secunia will add any specific vendor applications if required, starting by their research team monitoring said app for any vulnerabilities and in parallel creating a signature to detect the application within an SLA of 2 working days
- They utilise the software Inventory Agent within SCCM to asset scan, so uses existing infrastructure
- Results are fed direct into SCCM console, so are presented in your existing SCCM GUI, no retraining required

About Satisnet Ltd:
Founded in 2004, Satisnet Ltd is a leading IT Security Integrator dedicated to providing the highest level of customer care and technical support.

Satisnet have developed high level partnerships with a number of industry leading IT Security vendors including Secunia, IBM, Palo Alto Networks, Websense, AirWatch, VMware and Tenable. Together with our clients, we establish the most appropriate products and services to suit that particular organisations’ requirements, which would be dependent on factors such as industry, budget and compliance standards. We have a dedicated in-house technical team with the skills and expertise to fully support our products and services.

During this time our business has grown and we have established a strong professional reputation across a multitude of market sectors from Local Government, FTSE 250 to Financial and Charity organisations, with over 800 customers across Europe.

Find out more at http://www.satisnet.co.uk/

About Secunia:
Secunia is recognised industry-wide as a pioneer and global player within the IT security ecosystem, in the niche of Vulnerability Management. Their award-winning portfolio equips corporate and private customers worldwide with Vulnerability Intelligence, Vulnerability Assessment, and automated Patch Management tools to manage and control vulnerabilities across their networks and endpoints. A strong strategic vision of becoming number one is, and always has been, a founding pillar of Secunia. They deliver best-in-class solutions that have less superficial gift wrapping and instead contain true value. All Vulnerability Management products in Secunia’s portfolio provide proven endpoint protection against vulnerabilities, due to their special combination of unique application scanning, unrivalled expertise, and impeccable customer service. All of this is achieved by the dedicated efforts of the industry-renowned Secunia Research Team and enhanced by Secunia’s focused sales and support functions.

Find out more at http://www.secunia.com/

Agenda:
19:00 – 19:10 – Welcome
19:10 – 19:45 – Overview of Secunia CSI and System Center 2012 Configuration manager integration
19:45 – 20:00 – Q&A Session

When:
10th April, 2013 at 7PM GMT (convert timezone here)

Where
This is a virtual meeting using Microsoft Office Live Meeting, to register, click here

Who
Presenter bio:
John McCann, Director at Security Integrator, Satisnet, has been involved with IT for the last 30 years. He has worked in many environments ranging from a leading Defence company, through to Unisys, where he specialised in parallel processing solutions. For the last 20 years John has focused on working within the Information security industry, working for security vendors to include security startups , covering the ever evolving security challenges. In 2004 he founded Satisnet, a security integrator aimed at giving independent advice and on promoting best of breed technologies, while ensuring they operate and interwork with a customer’s existing infrastructure. Satisnet has some 800+ customers across Europe and has unrivalled expertise in implementing log management and SIEM for security and operational intelligence.

Morten Stengaard, is responsible for Secunia’s product management and QA function, defining Secunia’s product roadmap and ensuring that it is both commercially- and market-driven. In addition to this, he oversees Secunia’s Customer Support team who are responsible for delivering outstanding customer support. Prior to joining Secunia, Morten worked as Product Manager for the security software company BullGuard Ltd and Business Development Manager for the investment company Kukula Capital. He also co-founded a market analysis consultancy firm. Morten holds a B.Sc. in International Business (IB) and an M.Sc. in Finance & Strategic Management (FSM), both from Copenhagen Business School (CBS).

Host bio:
Raphael Perez is a Microsoft System Center Configuration Manager MVP based in UK, he specialises in System Center Configuration Manager (including OS Deployment) and other System Center products (Operations Manager, Service Manager, etc.) and is a WMUG community leader attending the physical meetings and engaging with the community across forums, twitter, LinkedIn and his blog. He is RFL Systems‘ owner, a System Center specialized consultant and training services within the United Kingdom.

3rd Party patch management - Part 8

Raphael — Tue, 12 Mar 2013 10:33:21 GMT

Hi all,

today we'll set up the CSI and to do this, you will need to run the csi as administrator

once you open, connect using your CSI username/password

if its the 1st time, it will ask you information about the password, recovery, etc...

once its done, you'll be able to scan hosts for vulnerabilities. to do this, just click on successfully scan one host link

select type 2 (all paths) and the ip addresses you want to scan or leave the default to scan the localhost only. click scan

scan will start

you can also check the reports to see the information about the scan on each computer.

Note: CSI can also connect to the SCCM via Software Inventory. in this series of posts i'm not doing this, instead, i'm using CSI built-in scan functionality.

that's it for this post, next one we will connect CSI with SCCM using the CSI plug-in connector.

3rd Party patch management - Part 7

Raphael — Fri, 08 Mar 2013 10:46:55 GMT

Hi all,

in this post i'll start preparing the server for Secunia CSI...

i'm using the CSI v6 that is compatible with Windows Server 2012 and System Center 2012 Configuration Manager SP1. To download it, go to secunia webpage (http://secunia.com/products/corporate/csi/). there is also the plugin for the SCCM and you can download it from http://secunia.com/vulnerability_scanning/corporate/sccm_plugin/

i'm using a server called SRV0004 where the CM12 SP1 is already installed.

before perform any setup, we need to configure the IE, to add the secunia website as trusted website. to do this, open the IE and go to options->security.

add the https://*.secunia.com to the trusted zone

after this let's start the setup of csi 6.0. On the welcome screen, click next

On the License agreement, click I accept the terms of the license agreement and click next

Readme Information, click Next

Choose the Install location and click Install

Complete the CSI Setup, click Finish

once the screen closes, click NO for the question about launching the Secunia CSI now.

well..that's it for this post..see you on the next one.

Microsoft Challenge

Raphael — Tue, 05 Mar 2013 14:47:39 GMT

hi All,

following my other Microsoft Challenge post (http://wmug.co.uk/wmug/b/dotraphael/archive/2013/02/27/microsoft-challenge-can-we-download-windows-server-2012-and-system-center-2012-sp1-15-000-times.aspx), Microsoft UK is now challenging the System Center MVP's and each one will have its own URL. The reason for this is that they want to know how quick we can get 250 downloads (not commulative, but the individual clicks)

if you want to help me to be one of the top in their list, use the following list

System Center 2012 SP1 (Iso): http://www.microsoft.com/uk/SC_DL_02
Windows Server 2012 (Iso): http://www.microsoft.com/uk/WS_ISO_DL_02
Windows Server 2012 (VHD): http://www.microsoft.com/uk/WS_VHD_DL_02

Note that you'll need to use your liveid to logon. Microsoft doesnt want us to click many times on the link...

can you help me out to be 1st to get 250 clicks?

Microsoft challenge, Can we download Windows Server 2012 and System Center 2012 SP1 15.000 times?

Raphael — Wed, 27 Feb 2013 12:20:11 GMT

Hi All,

Microsoft UK is challenging the UK MVP's and the challenge is simple....

Can we have 15000 downloads of Windows Server 2012 and System Center 2012 SP1?

In my opinion we can as we're a big community (I already downloaded my copies).

If you want to help us it is simple, download the software.

For the System Center 2012 SP1, you can get it from http://aka.ms/MVP_SC_1 and for the Windows Server 2012, there are 2 ways, 1 for the ISO http://aka.ms/MVP_WS_ISO_1 and 1 for the VHD http://aka.ms/MVP_WS_VHD_1

I hope we'll show Microsoft that we are up to any challenge

WMUG Event – SolarWinds – 13th February 2013 – Recorded

Raphael — Thu, 14 Feb 2013 10:13:51 GMT

Hi All,

thanks for Michael and Laurence from SolarWinds for the presentation yesterday as well as everyone that joined us.

If you could not attend, there is no problem, the meeting has been recorded and will be published soon....

thanks

WMUG Event – SolarWinds – 13th February 2013 – Virtual

Raphael — Tue, 12 Feb 2013 09:24:38 GMT

Hi All,

after a test, we did manage to get the meeting working, however, we needed to change the "provider". This time we'll be using GoTo Meeting.

The events page will be updated shortly as you can get more info about the event there (http://wmug.co.uk/Hubs/wmug_event_content/w/wmug_event_content-pages/default.aspx)

In the mean time, this is the new info:

Date/Time: 13th Feb 2013 - From 7-8pm (GMT)
Livemeeting registration link: https://www1.gotomeeting.com/register/800797665

hope you'll see you there.

WMUG Event – SolarWinds – 6th February 2013 – Virtual - Cancelled

Raphael — Wed, 06 Feb 2013 10:21:53 GMT

Hi All,

yesterday while we're doing a test we ran into a technical issue and due this reason, the livemeeting with SolarWinds has been cancelled.

We're testing another possibilities at the moment and confirming the availability of the presenters. We hope we'll be able to run this next week, but at the time being, we cannot commit.

We're really sorry and hope we'll have this issue fixed as soon as possible.

3rd Party patch management - Part 6

Raphael — Thu, 31 Jan 2013 09:58:15 GMT

Hi All,

this is the part 6, last one talking about SolarWinds Patch Manager, and in this post we'll see how to publish updates to be used by the SCCM...

1st, on the SCCM console, go to Software Library, 3rd Party Updates, Updates overview, all updates, this month

under Vendors, click Mozila, and select Mozila Firefox 10.0.12 ESR (Upgrade) and click Publish

Under publish, i selected publish selected packages to the wsus server, verify wsus version and re-sign existing selected package and clicked next

the server publishing verification wizard should be completed without any problem**. Once its done, click close

the patch manager publishing wizard will start and once done (downloading the files), select the update (or updates) and click next

the publishing process will start and after that you'll see the package publishing summary. you should see status: success

once its one, you can see this info on your sccm after the sync. to be sure, you can go to sup component properties and confirm the classification is being selected

and on the producs page, make sure that mozila/firefox is select

after that you can sync. i did a manual sync and i can see it on the logs

once on the all software updates, i can see Mozila Firefox as one of the updates, like any other microsoft update.

**note that if you have your WSUS/SUP Server on a WS12 server and installed the Patch Manager Server on a WS2008/WS2008R2 it will fail. the reason is that the wsus console version is not the same. you should use the same wsus console version, it means, if your wsus/sup is on a ws2012 server you must install patch manager on a ws2012 or w8 server. same applies with lower versions.

3rd Party patch management - Part 5

Raphael — Tue, 29 Jan 2013 14:01:07 GMT

Hi All,

this is the part 5 where we will see how to install a remote console and integrate with SCCM 2012 SP1. I'll be using the SCCM Site Server itself instead of a remote SCCM Console.

the 1st step, execute the patch manager setup

on the welcome screen, click next

accept the license agrrement and click next

as i have the wsus installed on the server, the following message will appear. click ok

on the select setup type, select custom and click next

select console install and make sure the Include SCCM 2012 Integration is selected. click next

on ready to setup your system, click next

once the installation is done, uncheck run solarwinds patch manager and click finish

now, open the sccm 2012 console and navigate to software library. you'll see a new node called 3rd party updates.

once you click on 3rd party updates, the connect to application server screen will appear. add the correct information (in my case srv0010) and click resolve and after that connect

on product features selection, select system center configuration manager extension pack and click continue

the sccm console will be configured

expand updates overview, catalogs to see all the catalogs we're using

on synchronizations, you can see all the synchronizations and results

3rd Party patch management - Part 4

Raphael — Thu, 24 Jan 2013 11:06:43 GMT

Hi All,

this is the part 4 where we will see how to prepare the environment (gpo and certificates). As we are using a self-signed certificate, we need install this certificate on all machines that will connect to the wsus, it means, every single machine on the network.

to do it easily, i'll be doing the changes on the default domain gpo...

1st step is to open the MMC console on the Path manager server, in my case SRV0010

on the menu file select add/remove snap-in. select certificates and click add

on this snap-in will always manage certificate for, select computer and click next

on select the computer you want this snap-in to manage, select Local computer and click finish

on the add or remove snap-ins, click ok

on the mmc console, expand certificates, trusted root certification authorities and select certificates, right click on WSUS Publishers self-signed certificate, all tasks, export

on the welcome to the certificate export wizard, click next

on export file format, select DER and click next

on file to export type the folder/file name or use the browse button. once done, click next

on completing the certificate export wizard, click finish

on certificate export wizard, click ok

now it is time to edit the GPO, to do this, on any machine with Group Policy management installed, edit the default domain policy

on the group policy management editor, expand computer configuration, policies, windows settings, security settings, Public Key Infrastructure and select Trusted Root Certification Authorities

Start the wizard to import the certificate and on the welcome screen, click next

on file to import, select the file you exported before and click next

on certificate store, click next

on completing the certificate import wizard, click next

on the certificate import wizard, click ok

note that the certificate was imported into the list

now it is time to import the same certificate into the Trusted Publishers.

once it is done, the certificate will appear in the list

now, expand computer configuration, policies, administrative templates, windows components, windows update

edit the allow signed updates from an intranet Microsoft update service location and select Enabled

once its done, you'll need to update the GPO on the machines either using gpupdate /force or rebooting the machine. and to validate if it has been applied properly, use the MMC and confirm that the certificate has been imported into the certificate stores

but what if you don't want use self-signed certificate? you can use any certificate from your company. to do this, check Jason T. Lewis blog post on http://blogs.technet.com/b/jasonlewis/archive/2011/07/12/system-center-updates-publisher-signing-certificate-requirements-amp-step-by-step-guide.aspx

3rd Party patch management - Part 3

Raphael — Wed, 23 Jan 2013 16:03:11 GMT

Hi all,

on this post we'll start the configuration of the software. to do this we need open the Patch Manager console.

on the Product features selection, select system center configuration manager extension pack and click continue

on welcome solarwinds patch manager getting started guide, click cancel

on wmi providers deployment settings, select YES and click OK. Doing this will allow Patch Manager to interact with WSUS

On select the domains and workgroups that contain computer you wish to manage, Atuomatic Discovery, click OK

On select the domains and workgroups that contain computer you wish to manage, click Add and fill up the information about your domain. once done, click OK

On select the domains and workgroups that contain computer you wish to manage, click next

on Add configmgr site servers, put the FQDN of the server into server name, click resolve and then click add

on Add WSUS server you would like to manage, put the FQDN of the server into server name and the correct port, click resolve and then click add

on create a new patch manager management group or select an existing management group, click next

on managed resource enterprise configuration wizard click finish

now it is time to give permissions, on create or modify credential ring, add the username/password for the sccm user and click add and then next

on create or modify credentials rules, click finish

now, it is time to configure the 3rd party catalog, on welcome the third party updates pack configuration wizard, click next

on proxy settings, click next

on connect to the third party updates site click start connection

once the connection is done, click next

on select vendors and products, select all products you want and click next (in this example i selected all catalogs)

on synchronization schedule, configure it and click finish

now it is time to create the certificate for your wsus server, on configure, select the wsus server you added before and click next

on wsus servers and patch manager servers, select both the wsus and the patch manager server and click next

on summary, click Finish. Note that there is a failure on my lab when publishing to my sccm/wsus server, this is due the lack of rights on the sccm/wsus server. do not worry about this, you'll fix this issue on the next post :)

on wsus client certificate and gpo management, click ok

now, the console is open, note that the console is based on MMC.

select administration and reporting->software publishing, see that the syncrhonization is happening (or maybe have finished already)

note: this is the only time we'll use the console (you can close it now :)), however, if you have more than 1 sccm/wsus server, many people needing different access, you'll need to give the proper rights here...but this is outside of this series of posts...