ConfigMgr 2012 : ConfigMgr

TechNet UK Article: How to Configure Alerts in System Center 2012 Configuration Manager

Rob Marshall - MVP — Sun, 14 Apr 2013 07:57:17 GMT

I wrote a little article for TechNet UK as a guest post where I go over the new Email Notifications mechanism in ConfigMgr 2012 SP1.

Check it out here

MS KB2823324 patch could cause loss of OS on next reboot if deployed

Rob Marshall - MVP — Sat, 13 Apr 2013 12:07:29 GMT

Lots of chatter out there on the web on this, Microsoft has pulled a patch, KB2823324, that is reportedly causing Windows OS’s not to boot properly or for application to not function correctly.

If you haven’t got this out into production yet, think it’d be a sensible precaution to remove it from any Deployment Packages and prevent any production instability until it is all resolved.

http://support.microsoft.com/kb/2823324

ConfigMgr 2012–Download the documentation for easier search

Rob Marshall - MVP — Fri, 22 Feb 2013 21:52:21 GMT

Best to download the docs and review offline now, TechNet (not the ConfigMgr team) have ripped out Classic view which helped us fully expand all the collapsible nodes to enable CTRL-F for searching, now you’ll have to expand the appropriate node out and read\search from there which is going to be a PITA unless you already know your way around.

Download here, when you do download keep an eye on the date and make sure you have the latest version installed.

Keep an eye on the ConfigMgr Team Blog for announcements regarding documentation updates

WMUG Event - SolarWinds - Patch Management

Rob Marshall - MVP — Tue, 12 Feb 2013 11:30:55 GMT

We had to reschedule our event for SolarWinds due to technical reasons but it is now back on!

Still a virtual meeting, but now set for the 13th of Feb 2013 at 7PM UK time, check out the Event page for more information.

Looks to be a very interesting presentation, don’t miss it!

http://wmug.co.uk/hubs/wmug_event_content/w/wmug_event_content-pages/56.wmug-event-solarwinds-13th-february-2013-7pm-virtual.aspx

ConfigMgr 2007/2012 now support SQL 2012 SP1

Rob Marshall - MVP — Tue, 12 Feb 2013 10:40:10 GMT

Over on the ConfigMgr team blog they made an announcement that ConfigMgr 2007 and ConfigMgr 2012 now support SQL SP1 support. There Is another reference in the announcement that the Endpoint Protection client will also support SQL 2012 SP1 and Operations Manager 2012 SP1.

You’ll see the documentation library updated in the coming month for this.

As a ConfigMgr admin you should bookmark the ConfigMgr Team Blog and the invaluable Documentation Library for this kind of announcement, keep your finger on the wire so to speak.

MVP Kenny Buntinx– PoSh to fix-up CM12 SP1 App DT’s post-upgrade from RTM

Rob Marshall - MVP — Mon, 28 Jan 2013 17:39:02 GMT

Kenny put together a nice method for fixing apps that won’t deploy via OSD post-RTM to SP1 upgrade. The script pokes the comment field which induces a ContentID which then causes the apps to redistribute to the DP’s and cleans up the issue.

Nice work Kenny!

http://scug.be/sccm/2013/01/27/configmgr-2012-sp1-powershell-script-to-repair-broken-applications-after-upgrading-them-from-rtm/

System Center 2012 SP1 RTM's - ConfigMgr SP1 is here

Rob Marshall - MVP — Tue, 15 Jan 2013 18:27:33 GMT

Our first service pack for ConfigMgr is now fully available!

Check out these MS announcement links

Delivering Unified Device Management with Windows Intune and System Center 2012 Configuration Manager SP1

Microsoft Advances the Cloud OS With New Management Solutions

Download Microsoft System Center Private Cloud Evaluation Software

Enjoy!

Re-awarded MVP ConfigMgr for 2013

Rob Marshall - MVP — Tue, 01 Jan 2013 17:26:44 GMT

The first day of the year at roughly the same time of the day I get a very exciting email. It’s not guaranteed, this is an invite-only renewed award so when it does arrive it makes my day:

2012 was a notable year indeed, so much happened, System Centre Configuration Manager 2012 arrived, we got two updates between RTM and SP1 and very soon we’ll all have SP1 (it’s on TechNet\MSDN but not Volume Licensing as of the time of writing), can you believe so much progress has been made by the ConfigMgr product team, like wow a new product, a wad of new features in SP1 and a stack of fixes in two new Cumulative Updates, Impressive year from just that alone. Way to go CM team!

A minor footnote in the year and best left buried in this paragraph was managing to get mutual agreement in the WMUG User Group to fell a tree that thought it could shake it’s leaves once a year while with us and do little else, major footnotes would be dropping contracting to open my own consultancy and training company focusing on the UK, primarily the City of London, working on short-term CM12 design and implementation engagements and providing training courses. Has worked out brilliantly, and I seem to be quite popular on the consultancy front. This style of work really fits with how I’ve developed over the years, but the really exiting thing that has my full attention right now is building out the training side of the company, I’m hoping to be both a training provider of other well-known and highly reputable courseware brands alongside my own training courseware.

My training is entirely bespoke and is purely for ConfigMgr, it is what I’m good at and I have so much knowledge collected over the years it’d be a crime not to form it up into something tangible and use it to train the way I want to do it. I’m pretty much done with the concept stage for both the content and the technical infrastructure required to facilitate the training, most of the hardware has been purchased and now I'm pretty much spending my time redefining the structure of the course and nailing the layout so that students get an amazing and very unique experience. Am hoping to have this ready for the second quarter of 2013 but don’t hold me to that, writing courseware is no easy thing! Massive time sink!

2012 was also the year I took on an apprentice. I’d like to introduce Jan Visnovec, currently not working in IT, but we’re building up his skills and hoping to get him ready for a career with ConfigMgr, building up his foundation skills, closing the holes in his knowledge, strengthening his observation and troubleshooting abilities. At the moment we’re focusing on SQL, WMI and a bunch of other non-CM related stuff in readiness for talking on the big boy product itself, ConfigMgr. Jan keeps a blog here, and over 2013 it’ll be fun to see how his journey towards attaining a career using ConfigMgr develops. I really enjoy teaching Jan, we pass around a lot of emails and every few weeks or maybe less depending on our availability we have a remote session where we cover hands-on stuff in mine or Jan’s lab and on the rare occasion a physical visit where we blow a few hours looking at stuff. He’s building up really well, and I’m looking forward to sharing more info and experience with him over the year; Keep an eye out for Jan at our physical events as he could be around. I got the idea of an apprentice from Microsoft who also run an apprenticeship, if you know someone who could do with some mentoring, why not define some boundaries and give it a go!

I’d like to thank the community as a whole for having problems that need fixing on the ConfigMgr Social Forums! They in turn may curse their luck but It is not only a place to help others but as an MVP (and this applies to them all) it is also a place for us to learn. Remember we may be pretty good with this product but we don’t know everything, we could during SMS2.0/SMS2003 days, but nowadays the product is just too complicated for us to understand every intimate detail. I think that is the buzz, it’s like a puzzle and our type are attracted to puzzles, our time on the forums is purely voluntary but we enjoy it and is why you see us responding so much. Also I’d like to thank those that read my blog and twitter tech spam, is a pleasure writing the guides and helping out where I can. This is why I enjoy working with this product after all this time, it pulls me in.

And finally, my thanks to my regional MVP lead, Claire Smyth, and her wonderful team for helping me make the most out of my MVP status, Wally Mead, my global MVP lead, you couldn’t ask for a finer technical role-model and group leader, and last but not least the product group themselves, thank you!

Enjoy 2013.

Robert Marshall

WMUG Virtual Event - Silect’s ConfigWise shoring up reporting

Rob Marshall - MVP — Thu, 15 Nov 2012 22:15:00 GMT

WMUG is holding another virtual event, on the 21st of November at 7PM GMT, this time a presentation from Simon Skinner (nubigenus) showing us Silect Software’s ConfigWise and how to get far more from your reporting on the Configuration Manager product.

Click here to find out more information on the event.

OSD Device Naming with UDA–Asset Check

Rob Marshall - MVP — Sat, 03 Nov 2012 10:08:00 GMT

Recently I had a Client who wanted to control the naming of their devices during the build cycle in OSD during New, Replacement and Upgrades scenarios, they also wanted to specify a User Device Affinity for some but not all devices. The mechanism had to leverage an initiative that was physically asset tagging all their devices and at the same time entering the tag into the devices SMBIOS. With all new devices being tagged like this on arrival, it meant a reliable relationship between the Asset Tag and a Device’s Name could be established and controlled.

The Client couldn’t of asked at a better time, John Vintzel from the ConfigMgr Product Team had blogged recently touching on the key elements needed to do this very task!

All I needed to do was have a control file containing the relationship data, which I call below the Asset Check Repository, and some VBScript to glue the processes together to A) identify the Asset Tag, B) locate a matching Tag in the Repository along with UDA if specified, and C) push these values into the appropriate Task Sequence Variables for the remaining Task Sequence steps to be processed.

I thought I’d finesse the mechanism a bit more then share with the community as its a cracking way to manage device naming and applying User Device Affinities within OSD.

Once you have your estate setup with SMBIOS Asset Tags, and have an entry in the Repository for each of them, you’ll be able to do BARE, REPLACE and UPGRADE builds while reusing the same device name, and managing any defined User Device Affinities so that Applications can be preloaded.

There are a couple of ways you can implement this yourself, the script instructions on how to set it up are below. It’s a long read but pretty much all my field notes and ideas are there. Enjoy and let me know if you get it working.

The format of the guide, was a bit freestyle, I just quickly built it up and tacked detail onto it in one sitting, so excuse me if it goes astray or I’ve missed something, I’ll edit the source post on Rob Marshall's WMUG blog as I see typo’s and add new content, I usually read it a few days later and tut, but I’m looking to update this mechanism, so a rewrite is inevitable!

Asset Check Script Features

I added in the ability to do automatic device naming, so, if the asset tag is found in the SMBIOS but not in the Repository it’ll continue and give the device a temporary name based on a prefix (currently set to TMP in the script) and the identified Asset Tag. These can then be seen in a ConfigMgr Collection with a query looking for the device name prefix (TMP% !), their Hardware Inventory will return the Asset Tag and you can then enter that into the Repository so it is named correctly at the next rebuild, hopefully creating a closed loop to capture any devices not in the Repository.

To toggle automatic naming, just edit the AssetCheck.vbs script and use TRUE (on) or FALSE (off) as highlighted in the screenshot above

If Automatic naming is disabled, custom errors are returned to indicate where in the process the error occurred:

9997 - Error setting the Task Sequence Variables

9998 – No Asset Tag Match in Repository

9999 – No Asset Tag found in SMBIOS

These can be viewed in Reports or in the SMSTSLOG.

Download the Asset Check Script

You can download the zipped AssetCheck.vbs file here from the WMUG website

So how do I configure my SMBIOS Asset Tags?

This is so out of scope it’s on another planet, no joking aside there are several ways to configure your SMBIOS settings but really this should be driven by some kind of device branding scheme, associating a devices physical Asset Tag with the SMBIOS digital Asset Tag. Ultimately somehow you need to do this association, physically or remotely, you’re going to need to figure out how to brand your existing estate.

The BIG ask - Asset Check Script - PowerShell or VBScript?

Put simply, when PowerShell is, by default, in all environments, as is VBScript, I’ll switch over to it completely, but we’re not there yet, almost, but not quite.

For ConfigMgr, we won’t get support for PowerShell in WINPE until ConfigMgr SP1 releases, this is because SP1 brings WINPE 4.0 support, which comes with WADK, and finally gives us .NET 4 and PowerShell packages which we can install.

The .NET and PowerShell WINPE 4.0 packages are not installed into any boot images by default, as is VBScript, hence why I feel PowerShell is not yet pervasive enough to replace VBScript entirely, and completely dominate engineering environments.

Eventually, PowerShell will become my scripting tool of choice, for all of my automation tasks, and if I was to take a stab at when this would be I’d say tail-end of 2014. By then I’d expect most people flitting through my guides to have PowerShell across their entire estate top to bottom, induced by OS upgrades (Win8, W2012), product upgrades (ConfigMgr SP1 for WADK, WINPE 4.0) and installing PowerShell onto older OS’s such as Windows XP, Windows 7 and Windows Server 2008 R2.

I saw the same take-up and switch-over debates when VBScript was announced. It took a long time for us to move off of custom MSDOS boot media such as Floppies, CDROMS, we held out for a long time, but eventually Microsoft pushed us forward and into 32-bit bootable environments where VBScript could be run at will, which ultimately lead to almost complete adoption in engineering teams as the scripting tool of choice. I saw estates running a mix of stuff such as Kix95, MSDOS Batch and VBScript, and seeing growth of VBScript adoption grow and eventually it became dominant, and now the same cycle is repeating for PowerShell.

We’re almost there, modern Microsoft Operating Systems have PowerShell installed by default, and it can be retrospectively applied to older operating systems as well as our engineering tools becoming PowerShell ready; Quite a few environments are ready now, but not all are, and this is why the guides script was written in VBScript, for the majority to implement.

I left out a lot of boot media history there, at the very least I should make a token nod at Barts boot disk amongst many others.

Invoke Asset Check during Pre-start or Task Sequence?

The Asset Check script can be invoked from a pre-start command in boot media, or via a Task Sequence Run Command Line step.

We’ll choose the latter, Run Command Line.

It’s entirely up to you where you locate the Asset Check scripts execution, both have advantages and disadvantages, both produce the same result, execution, we sure are lucky to have options!

The Asset Check Repository

Asset Check depends on the Repository being accessible during execution of the Task Sequence. The file itself is simply a three column (no header) CSV, here is an example

Asset Tag Machine Name User Affinity – UDA

123456789A ,LON123456789A CONFIGMGR\ConfigMgrUser

Here is a live AssetRepository.CSV file that I used in my lab during the creation of this guide

The Asset Tags in the above example come from Hyper-V 3.0, my test machines are called BUILDA, BUILDB, BUILDC, and I have a single user defined for UDA testing, ConfigMgrUser

Wherever you store your Asset Check Repository, you’ll need to maintain it, and depending on if you implement this at the start of OS deployment or after the deployment has taken place, this maintenance will be frequent or occasional.

Adding, removing and amending entries is pretty easy, just open the file and make the edits, there is only one rule and that is that if no UDA is required that you still include the comma

The following is valid notation:

Asset Tag,Device Name,SMSLAB\User

Asset Tag,Device Name,

The following is invalid notation (missing the comma):

Asset Tag,Device Name

Where should the Asset Check Repository file reside?

The Asset Check Repository file, a 3 column CSV file, can be stored alongside the Asset Check VBScript in a ConfigMgr Package, or it can be stored on a Network Share.

Using a Network Share

Advantages

The Repository is centralised, and made available to the Asset Check script over the network

The Repository is not spread out between engineering script locations, the ConfigMgr Package source location and any or all Distribution Points

Changes can be made to the Repository on-the-fly, the meantime between edits and execution is immediate

Disadvantages

Storing the Repository on a Network Share is not scalable in an Enterprise environment. For the next version of the script I’ll make the Network Share configurable as a script parameter so that it is.

The Share permissions are topical, the script is currently not configured to map a network drive under a domain users credentials, this can be done and I’ll implement this in the next version. Currently the connection is made to the share using the ANONYMOUS USER token, not the ConfigMgr Network Access Account. If you think about it this is by design, OSD mapped to the Package containing the Asset Check script using the Network Access Account in readiness for its execution, but when it was executed we then made another connection but this time it wasn’t handled by the Task Sequence engine and established using the Network Access Account

The server hosting the Network Share has to have a local Policy applied to allow the share to be used by the ANONYMOUS LOGON token

Using ANONYMOUS LOGON exposes Asset Tag, device naming standard and actual machine names for all to see within the company network, you can hide the share ($) but it can be navigated into if found. Most production networks will not tolerate this.

Using a ConfigMgr Package

The advantages

The source location for the package acts as the master copy and is distributed to the Distribution Points in the Hierarchy

The OSD device does not need to contact the network before it can check the Repository

The Disadvantages

The Repository file will now exist in your Package Source folder structure, you’ll need to change some permissions to allow Asset Check Repository editors access and full control, thus adding a dependency on the security configuration of the Package Source folder

Changes made to the Repository are latent, the meantime between edits and execution depends on how long it takes to copy the new Package source to the Distribution Points

If Run from Distribution Point is selected for the Deployment Types deployment, you’ll need to select the Packages option to copy the content to a package share, no big deal really

For this guide we’ll be using a Network Share. To be more secure use a Package, or modify the VBScript to establish the connection to the Network Share using credentials.

Configure requirements, and Deploy the Asset Check components

We’ll setup UDA affinity for the site, go through the process of creating and deploying a new ConfigMgr Package containing the VBScript, create and permission the Repository share while handling the Local Policy requirement for ANONYMOUS, and then we’ll modify an OS build Task Sequence to invoke Asset Check.

Configure the PXE Distribution Point or Bootable Media to accept UDA assignment's

Pretty simple to do, for the PXE Distribution Point just open the Distribution Points properties, Select the PXE Tab

From the drop down menu for User device Affinity select Allow user device affinity with automatic approval.

Do this to all your Distribution Points.

For Bootable Media, start the Create Bootable Media Wizard

The wizard will provide you with the option to enable or disable UDA. Recreate your media and from now on always choose this option when creating media.

Create the Asset Check Package

Prepare the Asset Check Package Source Location

First let’s copy the Asset Check VBScript to a new folder in your Package Source location. This location will be the one you specify when you follow the instructions below to create the Package.

Our 7K VBScript file now has it’s own Package Source location.

Prepare the ConfigMgr Package

Enter the Name as Asset Check, Version as 1 and set the Package Source Location using UNC as in the above example

Select Next

Select Do not create a program

Select Next

Select Close

Find the new Package and open it’s Properties

Select Enable binary differential replication

Select Data Access tab

Select Copy the content in this package to a package share on distribution points

Select Distribution Settings tab

Select Distribute the content for this package to preferred distribution points

Select Automatically download content when packages are assigned to distribution points

Select Allow this package to be transferred via multicast (WinPE only)

Select OK

Now Distribute this package to your Distribution Points

Select the Package and choose Distribute Content

Make sure you’ve added your Distribution Points and proceed to complete the wizard, and check the Distribution Status to confirm it has deployed to all Distribution Points successfully.

Create the Asset Check Repository Network Share

You now need to locate a server that can host the Asset Check Repository Network Share. This Network Share requires ANONYMOUS LOGON rights assigned, and the server told to allow ANONYMOUS LOGON with that Network Share only. You may have to deal with this within Active Directory Group Policy, and a special Group Policy object applied to server hosting the Network Share, or you can override it using a Local Policy override which is what we’ll do shortly.

Create the Asset Check Repository folder anywhere on your server, I chose the root of my VM’s only disk, resulting in C:\AssetCheck-Repository

Right click the new folder and get to the Properties

Click Advanced Sharing

Select Share this folder, replace the Share Name, I shorten it to AssetCheck

Select Permissions

Select Add, enter ANONYMOUS LOGON, press OK

Make sure Read is the only option selected

Select OK, OK and Close to complete

Navigate to the newly created folder

And finally, copy the AssetRepository.CSV file to this new folder.

Configure Local Policy for Network Share ANONYMOUS LOGON

We now need to configure Local Policy to allow the new Network Share to be accessed by the ANONYMOUS LOGON token

Open Local Group Policy Editor on the server hosting the Asset Check Repository Network Share (Start\RUN\GPEDIT.MSC)

Navigate to Computer Configuration \ Windows Settings \ Security Settings \ Local Policies \ Security Options

Locate and double click Network access: Shares that can be accessed anonymously

Enter the name of the Network Share, in our case it is called AssetCheck

Select OK and close the editor to complete

The Asset Check Repository Network Share and the Repository file are now ready to be accessed by your devices during build time.

You can test this by booting up in WINPE and trying to connect to this share without providing any credentials.

Amend the Build Task Sequence to include Asset Check

Now you need to add the Run Command Line step to your Task Sequence to invoke Asset Check. You can locate this step anywhere from the beginning of the Task Sequence all the way up to the Apply Operating System, step at which point the script must of executed or it’ll be too late.

Open your Task Sequence, add a Run Command Line step

Call the new step Asset Check

Enter the command line as cscript.exe AssetCheck.vbs

Tick Package and Select Browse

Select the Asset Check Package (Asset Check 1) and Select OK

The run this step as the following account is not an option as it cannot be used at this stage in the WINPE boot sequence

Select the Options tab

For Success codes enter: 0 9997 9998 9999

Tick Continue on error

Close your Task Sequence to commit the changes

That’s it, the Asset Check mechanism has been integrated.

Let’s fire up a VM and see it working. Make the VM boot from a PXE Point or from Bootable Media.

As soon as WINPE has finished loading press F8 (assuming you have debug switched on in your Boot Images)

Enter the following WMIC command to retrieve the existing Asset Tag

WMIC SYSTEMENCLOSURE GET SMBIOSASSETTAG

The SMBIOSAssetTag property is returned, if it’s blank, you’ll need to set it using a tool that’ll do the job on that device. The device will need a reboot after it is set

Now that you have the Asset Tag for this device, open the Repository and add it as new entry using the correct notation, providing the device with a device name and if you want to test UDA add a domain user in DOMAIN\USER notation. Save and close the Repository file.

If the Repository is in a Package, you’ll need to Update the Distribution Points before proceeding

Now let your device begin the Build Task Sequence

Wait until the Asset Check step has been processed

Now we can check out what happened without having to wait for the Task Sequence to complete. You can do this either by viewing the SMSTSLOG, or running a Report, we will run a report

As you can see, it is pretty clear what Asset Check did (click on the image above for larger view), it’s output is structured so you can determine what was configured, quickly. Here it shows that the three key Task Sequence Variables where set with valid values

Once the machine has completed the build, it’ll appear in the console as a Client

Oddly the Devices resource record UDA property Machine Assigned to User is set to False, I’m sure I saw this report another value before but things are still working evidenced by the shots below

If you specified a UDA relationship in the Repository for this Device and it was successfully created, the Device will have a Primary User associated with it

Perfect

And to make sure UDA was working Client-side, I setup the following deployment on the Site server

The 7Zip application (MSI) with a Deployment Type to Users Primary Devices

The 7Zip Deployment

There it is installed, before a domain user has even logged on

That’s pretty much it, I’ll work on a second version to smarten it up a bit more … if anything this shows how you can lasso together a few product elements to produce a very useful mechanism …

References

ConfigMgr 2012 SP1 Beta Boot Image Optional Components by Rob Marshall

http://wmug.co.uk/wmug/b/r0b/archive/2012/10/07/configmgr-2012-sp1-beta-boot-image-optional-components.aspx

Retrieving Identifying Information by Using the SMBIOS

http://technet.microsoft.com/en-us/library/ee156543.aspx

Configuration Manager 2012: User Device Affinity and OS Deployment by John Vintzel

http://blogs.technet.com/b/inside_osd/archive/2011/06/20/configuration-manager-2012-user-device-affinity-and-os-deployment.aspx

Wally Mead back in the UK presenting on ConfigMgr 2012 SP1

Rob Marshall - MVP — Thu, 25 Oct 2012 23:14:42 GMT

It’s becoming a regular annual feature now, and this year is no exception with Wally Mead joining WMUG for the day on the 10th of November 2012!

We’re back in Reading for this event, at the Microsoft UK TVP Campus. We have the Chicago room and can seat a 100.

Really stoked about this one, Service Pack 1 introduces some awesome tech, and although Wally won’t be able to cover it all, he’ll damn well try!

This years event is a bit special as we’ve had to go for a Saturday over a working week day which may make it difficult to attend, but I'll be hanging out there during the day along with a few of the WMUG gang, and the content is pretty much ConfigMgr Service Pack 1. This really is a not-to-be-missed--if-your-a-ConfigMgr-admin free event!

Click here for more information and how to book.

http://wmug.co.uk/hubs/wmug_event_content/w/wmug_event_content-pages/54.wmug-event-a-day-with-wally-mead-covering-configmgr-2012-rtm-and-sp1-on-10th-of-november-2012.aspx

Cool Import and Export mechanism for ConfigMgr 2012

Rob Marshall - MVP — Wed, 24 Oct 2012 20:24:00 GMT

Check out this pretty cool script to automate some of the Import\Export feature we have in ConfigMgr 2012.

Jon uses Task Sequences, you export the metadata only including dependencies, the script manipulates the resulting payload in readiness to be imported into another Site server by changing the UNC paths so that the newly imported objects point at a new source staging location.

http://wmug.co.uk/wmug/b/jon/archive/2012/10/24/configmgr-2012-powershell-script-to-assist-export-import-of-task-sequences-and-all-dependencies-between-sccm-servers-environments.aspx

I saw this being developed, nice idea Jon and I’m really looking forward to seeing you grow it some more

ConfigMgr 2012 AD Group and Collection creation tool

Rob Marshall - MVP — Tue, 09 Oct 2012 17:09:50 GMT

Kaido Järvemets another ConfigMgr MVP put together a really cool tool to create AD groups and ConfigMgr Collections, hosted on the ConfigMgr PowerShell SDK website

Loving the stuff this guys producing using PowerShell.

ConfigMgr 2012 SP1 Beta Boot Image Optional Components

Rob Marshall - MVP — Sun, 07 Oct 2012 21:03:45 GMT

ConfigMgr 2012 SP1 brings a bunch load of new features for us to check out, one of which, and the subject of this quick guide provides functionality in the Console to add Optional Components to a WINPE Boot Image. To achieve this previously we had to do a bit of hand crafting (manual steps) using DISM packages so it’s a relief that this is all integrated into the console now

First get your base boot image and add it to your boot source location. To do this copy either the x86 or x64 boot image from the following location

C:\Program Files\Microsoft Configuration Manager\OSD\boot\x64\boot.wim

C:\Program Files\Microsoft Configuration Manager\OSD\boot\i386\boot.wim

to the location you store your OSD source files

Example: \\SERVERNAME\PKGSOURCE\OSD\BOOTIMAGES

Rename the BOOT.WIM to a new name

CUSTOMBOOT.WIM

Open the ConfigMgr 2012 SP1 Beta Console

Select Software Library and navigate to Boot Images under Operating Systems

Either right click Boot Images or select Add Boot Image from the ribbon

Enter the source location for the custom boot image, select the boot image itself and select Next

Give it a friendly name, I meant to call it Optional ...

Select Next

Select Next to import the boot image and prepare it for ConfigMgr use

It shouldn't take more than a minute or two to add the boot image to ConfigMgr 2012 SP1 Beta

We've now added the boot image to ConfigMgr, we can now see the new Boot Image in the Boot Images view

Highlight the new boot image and either right click Properties or select properties on the Ribbon

This is the new tab that allows us to add and remove optional components

You'll see a bunch of components that have been added for ConfigMgr use, these base components weigh in at 15MB or so, and cannot be removed without resorting to messing with the WINPE boot image directly

Let's add some additional components

Select the Starburst as usual to add a new item

We get a list of all the components ConfigMgr can add to the boot image. Listed is the component name and the file size making it easier to predict boot image size increases

Select Windows Powershell (WinPE-DismCmdlets)

Like Server Manager we get a dependency warning and a choice to add the dependent components to the list. That’s .Net 4 about to install into the Boot Image, that could be very handy for companies who want to put on their own front end for UDI or other purposes

Select OK and we now see Microsoft .NET (WinPE=NetFx4) and Windows PowerShell (WinPE-PowerShell3) also selected

Let's add a few more Optional Components

HTML (WinPE-HTA)

Windows PowerShell (WinPE-StorageWMI)

Database (WinPE-MDAC)

Select OK to the Optional Components dialog

We don't have to install any of these optional components, I'm selecting them to see how much the boot image file size increases, if you where to produce a boot image for production you'd only enable the optional components that are essential for use

Select OK to begin updating the boot image

Select Yes

Usual summary, select Next

Done. Select Close

Here's a look at the file sizes

Above: Before the optional components were installed

Above: After the optional components were installed

Boot Image	MB	Bytes
Original BOOT.WIM	182MB	191,500,982
Imported Boot image	197MB	207,036,312
Boot image with optional components	327MB	343,643,957

The above tables shows how large our boot image became (actual file size, not size on disk)

It’s worth noting here that once all those optional components were put on to the boot image it shot up to 327MB, compared to 197MB for a ConfigMgr primed Boot Image. Once you start adding in your mass storage drivers and any network drivers you might require you’ll be heading north of 400MB. Ideally you want to keep these images as small as possible, especially if they are going across PXE, stripping out drivers you don’t need and keeping the optional components turned off where not needed

With this new tab in the boot image properties, adding optional components couldn't get any easier. All that leg work taken out and added to the GUI, very nice

Antivirus file extension exclusions for EndPoint in ConfigMgr

Rob Marshall - MVP — Mon, 01 Oct 2012 09:48:22 GMT

Really good antivirus file extensions exclusion list from fellow MVP Peter Daalmans. This is really helpful thanks Peter!

Asset Tag	Machine Name	User Affinity – UDA
123456789A	,LON123456789A	CONFIGMGR\ConfigMgrUser