Wednesday, November 20, 2013

do not mess with WSUS or how to get crazy with software updates.

when you are configuring SCCM 2007 or SCCM 2012 it is stated on the TechNet and all blogs:

DO NOT MODIFY WSUS CONFIG MANUALLY!

Just install WSUS role and then SUP role. SCCM will configure everything it needs on its own.

it is also known by advanced users that yes, you can fine tune some things through WSUS console, but only when you've got enough experiance and you know exactly what you are doing.

why am i telling this?

a colleague of mine is involved with a customer for almost a year now. the IT guys there managed to set up SCCM 2012 on their own and it even works now, after we've spent a few month (re)configuring and fine-tuning it for all their needs. unfortunately they still don't know how SCCM 2012 works and is something happens they just blame SCCM for it and start nagging.
The last issue they've had was really weird - they are using Forefront as well and everything was fine until approximately a month ago the clients started receiving Forefront engine update that was causing system reboot. It is a health care organization and they can't afford unexpected or not announced desktop reboots. The strange thing was that this update wasn't approved on SCCM site. It wasn't even downloaded to a package. so... it was a big mess :O... the local IT disabled the ADR, they've even deleted and recreated it, and disabled again... configured update source location settings and so on... but nothing could help.
The local IT guys were going to make some dramatic decisions like completely wiping SCCM 2012 site server and reinstalling it from scratch of calling Microsoft Premium support, or may be even both of those steps (in the right sequence ;) )

Just before that happened, my college has decided to get involved and just take a look at complete chain of severs, clients and applications involved. After some deep digging in an affected client's logs, site server logs, lots of other logs, all the relevant SCCM 2012 console parts... he went to WSUS console, to look if he could find something "unusual"...
AND HE HAS FOUND IT!!!

WSUS has got "Default Automatic Approval Rule" and it was enabled!!!


well what can i say...
Back in SCCM 2007, when you wanted to automatically update Forefront clients from SCCM, you, indeed, needed to configure certain settings on WSUS server to make it work. but it is no longer the case with SCCM 2012, so do not do that!!!
unfortunately some wise guy had itch on his fingertips and didn't have proper understanding of what he was doing...

so, once again - DO NOT MESS WITH WSUS!
and of course - make sure you've got proper understanding of what you are doing and how it all works.

Tuesday, November 19, 2013

upgrade to 2012 R2 or how to kill your (LAB) SCCM 2012 environment

every once in a while we do some things in System Center environment
... sometimes those things are cool and we are proud to share it with everybody around
... sometimes those things are quiet crazy, and not always worth sharing ... or are they? ;)

recently I've killed my System Center 2012 LAB while upgrading to 2012 R2 release :D

don't worry, the actual upgrade from System Center 2012 to System Center 2012 went perfectly well and this process is already covered into certain extend on the different blogs. I personally like Anoop's coverage of upgrade to SCCM 2012 R2, for example.

Any way the simple story of how i destroyed my LAB:

one day, soon after the System Center 2012 R2 and Windows Server 2012 R2 bits were released for GA i was enjoying a brain killing Change Advisory Board meeting at a customer, it had a huge agenda and i had no excuse to escape. After first 5 minutes i've realized that i was already brain dead and it'll take just a few more minutes at most to switch into a coma sleep. I had to do something to prevent insulting the customer's management...
And I've found!!! I've decided to upgrade my System Center 2012 LAB to the R2 release.
unfortunately i've got a very fast notebook with lots of RAM and SSD's and event updating both SCCM 2012 and SCOM 2012 servers simultaneously went pretty fast and without issues...
So i was where i've began fighting the fight i could never win against the coma-sleep...
Apparently my brain was  severely damaged at that time and i've decided to upgrade my LAB's OS to Windows Server 2012 R2 from Windows Server 2008 R2 i was happily using for a while...
AND I DID IT :D
it was quiet straight forward, and upgrading DC and two management server went reasonably fast.
well... usually i do create VM snapshots before i want to test even a small change, but this time i thought - it's just my own LAB, what can happen?
DC worked perfectly after upgrade...
SCOM 2012 R2 also worked perfectly after upgrade...
SCCM 2012 R2 also worked perfectly after upgrade... well, actually it seemed to work, but i've discovered quite soon that it was quiet messed up:
  • Software update Point - wasn't working because WSUS service wasn't running. When i've checked, i've discovered that WSUS was just messed up after upgrade. Removing SUP and WSUS and reinstalling them didn't resolve those issues.
  • PXE - wasn't working becauseWDS was messed up. After removing all DP roles and DP itself and reinstalling WDS the PXE errors in event log to be resolved.
  • Management Point - MP was acting weird. After some investigation it appeared that some IIS components and settings were messed up during server OS upgrade.
After i've noticed IIS issues, i didn't even tried to resolve them... maybe because the meeting was over :D...
... instead i've deleted the VM and created a new clean W2K12_R2 build with SCCM 2012 R@ and SCSM 2012_R2 on it.

somebody may ask me - why did you do this in the first place?
the answer is as simple as it can - my other customer had actually asked me if they could perform inplace OS upgrade of they servers because they are moving all of their servers to W2K12_R2 asap.

the short answer (at least for SCCM 2012 site servers) is don't.

if you want to upgrade OS of your site server from W2K8_R2 to Win12, then perhaps you should consider using old fashioned backup and restore instead of inplace upgrade.
HOW TO UPGRADE your server OS?
just back-up your whole source site server.
get a new VM with the same disk layout and identical name and restore the ConfigMgr site to the new server.
have fun :)

By the way, do you want (or nee/must) upgrade your site server's OS from 32-bit to 64-bit?
Then this back-up and recovery is the only possible way to achieve the result.

Monday, November 4, 2013

Using SCCM 2012 Compliance Settings to update license files

when you are using licensed applications, some of them require locally present license files and this files needs to be updated once in a while. one way to do it is just to push the new license file to all clients and go drink some coffee...
... but there is a more intelligent way to achieve this goal through utilizing Compliance Settings in SCCM 2012...

... So, lets take a look on how to update Immidio Flex+ license from SCCM 2012 utilizing Compliance Settings feature.

if you are wondering what Configuration Settings feature is, take a look on this TechNet article.
BTW in SCCM 2007 it was called Desired Configuration Management ;)
i'm not going to explain Configuration Settings in detail, because there are already a lot of people who spent enough time doing it, for example guy's from Windows Noob. The important thing for this article is what Compliance Settings can and can't remediate.
Compliance Settings can only remediate Registry, Script and WMI.
REMEMBER - remediation is only supported for "Equal" Operator. If you set operator other than ‘Equal’ the remediation option will disappear.
This TechNet forum post contains good explanation on can and can't do topic.

Beacuse we cannot remediate file, we'll have to create collection, based on compliance status, and deploy new license file to that collection.


The approach is simple:
- create Configuration Items and Configuration Baseline.
- deploy that baseline to a device collection.
- create query based collection that includes all non-compliant devices.
- deploy new license file to the collection containing non-complient clients.

Disclamer - this post assumes the reader has got basic knowlege of SCCM 2012 and has access to properly configured and working SCCM 2012 site with software distribution and (custom) client settings etc.

Create Compliance Settings:

Create  Configuration Item
in Configuration Manager Admin Console go to "Assets and Compliance"->"Compliance Settings"
click on "Configuration Items" and select "Create Configurattion Item" on the ribbon.



On the General page of the New CI Wizard call it Configuration Iten "[CI] Flex+ license" and click on "Summary" and "Next"





Now we've got the new Configuration Item in console


double click on the newly created Configuration Item, go to "Settings" tab and click on "New"


configure the settings on the General tab as shown on the screenshot below and click on OK





NOTE - The path is target dir where the license file is located on the clients. In this case it is the installation folder for Immidio Flex+.

now, switch to the Compliance Rules tab and create two colpliance rules.





1-st rule will check if the license file exists
NOTE - this rule might not seem to be really necessary, but some times you want to verify if the clients has got the license file at all.



and the second rule will check the creation date of the license file



NOTE - for this sample i'm using two Flex+ demo license files, one of them was created on 2013.10.25 and another one a few days before. For this example the new file has to replace the old one somehow.

Create Configuration Baseline
in Configuration Manager Admin Console go to "Assets and Compliance"->"Compliance Settings"
click on "Configuration Baseline" and select "Create Configuration Baseline" on the ribbon.



provide the name of the Configuration Baseline
click the "Add" button and select "Configuration Item" from drop-down menu




in the Add Configuration Items wizard select [CI] Flex+ license Configuration Item we've preveously created, click "Add" and then "OK".

After "Configuration Baseline" has been created, deploy it to you target collection. Deployment process is the same as for anything else in SCCM 2012 - just right click on the thing you what to deploy and choose "Deploy" option ;)

before we'll proceed add "CI ID" field to the view in Configuration Baselines section. we'll need it later to create the collection query




Create Collection:

now that we've got Configuration Baseline created and deployed and assuming that enougth time/effort passed to get the baseline to the clients, evaluate it and report back to the SCCM site...
we'll create device collection based on evaluation results which will contain all the clients

create device collection
in this case i've named it  "[software] Immidio Flex+ 8.1 license update", but feel free to use any other name :D



the most important part of this collection is the query-based membership rule
in the Membership Rules  step of the wizard click on "Add Rule" and select "Query Rule" from the drop-down menu


give your query a name and click on "Edit Query Statement"



 switch to the "Criteria" tab and add two query criteria

1-st criteria will be our Configuration Baseline's "CI ID"

in the "Criterion Properties" click on "Select" button 



and set "Configuration Item Compliance State" as "Attribute Class" and "CIID" as value.



after clicking on the "OK" we are back in "Criterion Properties"
remember that we've added "CI ID" field to the "Configuration Baseline" window view? this is the place where we need those 8 digits.
NOTE - do not forget to replace CI_ID value with the correct CIID from your environment!




2-nd criteria will be our Configuration Baseline's "Compliance State"





Optionally, you can just click on "Show Query Language" button



and paste the query below into it.

select *  from  SMS_R_System inner join SMS_G_System_CI_ComplianceState on SMS_G_System_CI_ComplianceState.ResourceId = SMS_R_System.ResourceId where SMS_G_System_CI_ComplianceState.CI_ID = 16811141 and SMS_G_System_CI_ComplianceState.ComplianceStateName = "Non-Compliant"

NOTE - do not forget to replace SMS_G_System_CI_ComplianceState.CI_ID value with the correct CIID from your environment!

Deploy license file:

This part doesn't differ from any other software deployment activity.
just create a software package, containing the license  file you want to deploy or update, and script to do the job and you are done.

after some time, depending on collection evaluation time, client policy settings etc, we'll see the license file being updated where necessary.